CVE-2026-101148Critical· 10.0▾ Midnight

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups…

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score55/ 100 · Moderate

impact 55 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 1, 2026

Updated

Oct 1, 2026

CVSS

10.0

Vendor

—

Product

BackupSheep WordPress Backup Plugin

CWE

CWE-73

Depth score

55 · Moderate

EPSS

0.31% · p24

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

decided 2026-10-01

Exploitation: none
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 2.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 1 day

Oct 1, 2026Published
Disclosed via NVD
Oct 1, 2026CVSS changed
— → 10
Oct 1, 2026Severity changed
none → critical
Oct 2, 2026EPSS first tracked
0.3%

CWE-73 #nvd #cve.org

Affected

backupsheep_wordpress_backup_plugin <= 1.8

Full technical detail▾

Overview

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover.

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

[email protected] — https://wpscan.com/vulnerability/5d6fce13-34e3-4ec6-9b47-a78dd7c94fed/

Change history

Field changes observed since this record was first indexed.

Oct 1, 2026CVSS — → 10
Oct 1, 2026Severity none → critical

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score55/ 100 · Moderate

impact 55 · likelihood 0.1 · exploitation 0

Overview

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.