PT-2026-22121 · WordPress · Worry Proof Backup

Athiwat Tiprasaharn + 1 · Published 2026-02-26 · Updated 2026-03-03 · CVE-2026-1311

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Worry Proof Backup versions up to and including 0.2.4

Description The Worry Proof Backup plugin for WordPress is susceptible to a path traversal issue in all versions up to and including 0.2.4 through the backup upload functionality. Authenticated attackers with Subscriber-level access or higher can upload a malicious ZIP archive containing path traversal sequences. This allows them to write arbitrary files anywhere on the server, including executable PHP files, potentially leading to remote code execution (RCE). The vulnerability resides in the way the plugin handles file uploads, specifically allowing manipulation of file paths.

Recommendations Versions prior to 0.2.4 should be updated to a newer, fixed version when available.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-1311

Affected Products

Worry Proof Backup

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-1311 · Security Note
• https://t.me/cveNotify/153291 · Telegram Post
• https://twitter.com/cracbot/status/2028787654662512873 · Twitter Post
• https://plugins.trac.wordpress.org/browser/worry-proof-backup/tags/0.2.4/inc/libs/upload-backup.php#L97 · Note
• https://twitter.com/VulmonFeeds/status/2026919229774069968 · Twitter Post
• https://twitter.com/CveFindCom/status/2026895312711737443 · Twitter Post
• https://twitter.com/CveTodo/status/2026892047303471174 · Twitter Post
• https://twitter.com/CVEnew/status/2027004196709417350 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3ffd6ce0-2536-43a5-9925-438bc653d0e5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/worry-proof-backup/trunk/inc/libs/upload-backup.php#L97 · Note
• https://t.me/CVEtracker/45829 · Telegram Post