CVE-2026-3339: Path Traversal in Keep Backup Daily

An attacker exploiting this vulnerability could gain access to sensitive files and directories on the web server. This could include configuration files, database credentials, or even source code. While the vulnerability requires administrator access, successful exploitation could lead to a significant compromise of the WordPress site and its underlying infrastructure. The ability to list arbitrary directories provides a reconnaissance opportunity for further attacks, potentially leading to data exfiltration or system takeover. This vulnerability shares similarities with other path traversal exploits where attackers leverage insufficient input validation to bypass security controls and access unauthorized resources.

1. Reserved2026-02-27
2. Published2026-03-20
3. Modified2026-04-08
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-3339 is to upgrade the Keep Backup Daily plugin to version 2.1.3 or later. If upgrading is not immediately feasible, consider restricting file access permissions on the server to minimize the potential impact of a successful exploit. Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../) in the kbd_path parameter. Regularly review WordPress plugin installations and ensure they are from trusted sources and kept up to date.

Active installs

300Niche

Plugin rating