{"id":"CVE-2026-101148","published":"2026-10-01T06:17:04.057","lastModified":"2026-10-01T13:11:52.923","description":"The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover.\n\nThe BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-73"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/5d6fce13-34e3-4ec6-9b47-a78dd7c94fed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows unauthenticated attackers to create and download full site backups, including sensitive data, and delete arbitrary files, leading to potential data disclosure and site takeover.","exploitability":"Exploitation is relatively easy as it requires no authentication and can be automated, but attackers must have access to the integration key or be able to unset it.","blast_radius":"If exploited, the impact is high, as it can lead to sensitive data disclosure and complete site compromise.","remediation":"Remove the BackupSheep WordPress Backup Plugin from any site where it is installed.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["web","backup","file-deletion","data-disclosure"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:41:24.332Z"}}