Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 23:04:36 +0000 CVE-2026-86828 — BackWPup < 5.7.7 - Admin+ Path Traversal to RCE via Restore PclZip Fallback https://vulnerability.circl.lu/vuln/cve-2026-86828 <p><strong>Affected:</strong> Unknown BackWPup</p> <p>The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.</p> <p><strong>Affected:</strong> Unknown BackWPup</p> <p>The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.</p> https://vulnerability.circl.lu/vuln/cve-2026-86828