{"id":"CVE-2026-86828","published":"2026-10-08T06:16:45.287","lastModified":"2026-10-08T20:51:18.123","description":"The BackWPup  WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.","cvssScore":6.6,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/be8c0eab-1874-4490-b94e-394f62a522f3/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}