PT-2026-7851 · WordPress · Wordpress+1

Athiwat Tiprasaharn + 2 · Published 2026-02-12 · Updated 2026-02-12 · CVE-2026-1104

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FastDup – Fastest WordPress Migration & Duplicator plugin versions up to 2.7.1

Description The FastDup plugin for WordPress is affected by a flaw that allows unauthorized backup creation and download. This is due to a missing capability check on REST API endpoints. Authenticated attackers with Contributor-level access or higher can create and download full-site backup archives, including database exports and configuration files. The affected API endpoints are not explicitly specified, but the issue relates to REST API functionality. The vulnerability allows access to the entire WordPress installation data.

Recommendations Versions prior to 2.7.1 should be updated to address this issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1104

Affected Products

Fastdup

Wordpress

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-1104 · Security Note
• https://plugins.trac.wordpress.org/browser/fastdup/trunk/includes/Endpoint/PackageApi.php#L371 · Note
• https://plugins.trac.wordpress.org/changeset/3449530 · Note
• https://twitter.com/CVEnew/status/2021980017274839238 · Twitter Post
• https://t.me/CVEtracker/44536 · Telegram Post
• https://twitter.com/CveFindCom/status/2022010645525201125 · Twitter Post
• https://twitter.com/TheHackerWire/status/2021975215283351881 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2021982226519302648 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/29c0fb4d-c38c-4c78-9e15-797f3c3a4b30?source=cve · Note