What is GHSA-qr55-6j78-v53m?

GHSA-qr55-6j78-v53m is a security advisory published by GitHub Security Advisories with Medium severity. The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its...

Which CVE IDs does GHSA-qr55-6j78-v53m cover?

GHSA-qr55-6j78-v53m covers the following CVE IDs: CVE-2026-86815. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qr55-6j78-v53m?

GHSA-qr55-6j78-v53m has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

GHSA-qr55-6j78-v53mMediumCVSS 5.5

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-86815 →

📋 Description

The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited role to create and run backup jobs and exfiltrate a full database backup to an attacker-controlled destination.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-86815
https://wpscan.com/vulnerability/fa66c458-f14f-47bc-87e6-b603200ef8e9
https://github.com/advisories/GHSA-qr55-6j78-v53m