PT-2026-20623 · WordPress · Backup/Restore Wordpress – Backup Plugin

Rafał · Published 2026-02-19 · Updated 2026-02-23 · CVE-2025-15041

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BackWPup – WordPress Backup & Restore Plugin versions prior to 5.6.3

Description The BackWPup – WordPress Backup & Restore Plugin for WordPress is susceptible to unauthorized data modification, potentially leading to privilege escalation. A missing capability check within the save site option() function allows authenticated attackers with a level of access and above to modify arbitrary options on a WordPress site. This can be exploited to elevate privileges, for example, by changing the default registration role to administrator and enabling user registration, thereby granting attackers administrative access.

Recommendations Update BackWPup – WordPress Backup & Restore Plugin to version 5.6.3 or later.

Fix

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-15041

Affected Products

Backup/Restore Wordpress – Backup Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-15041 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3443073%40backwpup&new=3443073%40backwpup&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/2025892077683261536 · Twitter Post
• https://plugins.trac.wordpress.org/browser/backwpup/tags/5.6.1/src/Jobs/API/Rest.php?marks=88,337,788-812#L88 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2ab8f440-2910-41a3-8bbc-afb4cafd33b5?source=cve · Note