CVE-2026-6227: LFI in BackWPup – WordPress Backup Plugin

An attacker exploiting this LFI vulnerability could gain access to sensitive files on the WordPress server. The description specifically mentions the potential to read the wp-config.php file, which contains database credentials and other critical configuration information. Successful compromise of wp-config.php would allow an attacker to gain complete control over the WordPress site and its database. Furthermore, the vulnerability description indicates that remote code execution (RCE) is possible in certain configurations, significantly expanding the potential impact. This could allow an attacker to execute arbitrary commands on the server, leading to data breaches, website defacement, or complete system compromise.

1. Reserved2026-04-13
2. Published2026-04-13
3. Modified2026-04-14
4. EPSS updated2026-04-21

The primary mitigation for CVE-2026-6227 is to immediately upgrade the BackWPup plugin to version 5.6.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider restricting access to the /wp-json/backwpup/v1/getblock endpoint. Implement strict access controls to ensure only authorized users (administrators) can access this endpoint. Web Application Firewall (WAF) rules can be configured to block requests containing suspicious path traversal sequences (e.g., ....//). After upgrading, verify the fix by attempting to access the /wp-json/backwpup/v1/getblock endpoint with a crafted path traversal payload; the request should be denied.

Active installs

500KKnown

Plugin rating