Cyber Posture

CVE-2026-1311

High

Published: 26 February 2026

Published
26 February 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0014 34.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a…

more

malicious ZIP archive with path traversal sequences to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Implements input validation mechanisms on ZIP archive uploads to reject path traversal sequences, directly preventing arbitrary file writes to server locations.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of the path traversal flaw in the backup upload functionality of the Worry Proof Backup plugin.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to restrict backup upload functionality to roles above Subscriber-level, blocking exploitation by low-privilege authenticated users.

Security SummaryAI

CVE-2026-1311 is a Path Traversal vulnerability (CWE-22) in the Worry Proof Backup plugin for WordPress, affecting all versions up to and including 0.2.4. The flaw exists in the backup upload functionality, enabling improper handling of ZIP archives. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-26T05:17:41.933.

Authenticated attackers with Subscriber-level access or higher can exploit the vulnerability by uploading a malicious ZIP archive containing path traversal sequences. This allows them to write arbitrary files to any location on the server, including executable PHP files, which can result in remote code execution.

Advisories reference the vulnerable code in the plugin's inc/libs/upload-backup.php file at line 97, as shown in the 0.2.4 tag and trunk versions on the WordPress plugins trac, along with a Wordfence threat intelligence page (ID: 3ffd6ce0-2536-43a5-9925-438bc653d0e5). No specific patch or mitigation details are outlined in the provided references.

Details

CWE(s)
CWE-22

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Path traversal in WordPress plugin enables low-priv authenticated attackers to write arbitrary files for RCE, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References