PT-2026-26714 · WordPress · Keep Backup Daily

San6051 · Published 2026-03-20 · Updated 2026-03-21 · CVE-2026-3339

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Keep Backup Daily plugin for WordPress versions up to and including 2.1.1

Description The Keep Backup Daily plugin for WordPress is susceptible to a Limited Path Traversal issue. This is a result of inadequate validation of the kbd path parameter within the kbd open upload dir AJAX action, where only sanitize text field() is used for sanitization. This insufficient sanitization allows authenticated attackers with Administrator-level access or higher to potentially list the contents of directories outside the intended uploads directory on the server.

Recommendations Versions prior to and including 2.1.1 should be updated.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-3339

Affected Products

Keep Backup Daily

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-3339 · Security Note
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/trunk/inc/functions.php#L855 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481587%40keep-backup-daily&new=3481587%40keep-backup-daily&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/01984754-e332-4500-99a2-10a7b79967f5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L871 · Note
• https://twitter.com/CVEnew/status/2035262104265982411 · Twitter Post
• https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L855 · Note