CVE-2026-1104

High

Published: 12 February 2026

Published

12 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0006 17.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1104 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 17.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations on REST API endpoints to prevent authenticated low-privilege users from creating and downloading unauthorized backups.

AC-6 Least Privilege good match

prevent

Applies least privilege to restrict Contributor-level users from accessing sensitive backup creation and download functions in the plugin.

SI-2 Flaw Remediation good match

prevent

Remediates the missing capability check flaw by identifying, testing, and installing the plugin patch beyond version 2.7.1.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

T1552.001 Credentials In Files Credential Access

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

attack.mitre.org →

Why these techniques?

Missing authorization on public WP REST endpoints directly enables remote exploitation of a web app (T1190) to create/download full backups, exposing local system data (T1005) including credentials in config/DB files (T1552.001).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it…

possible for authenticated attackers, with Contributor-level access and above, to create and download full-site backup archives containing the entire WordPress installation, including database exports and configuration files.

Deeper analysisAI

CVE-2026-1104 is a vulnerability in the FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress, affecting all versions up to and including 2.7.1. It arises from a missing capability check on REST API endpoints, classified under CWE-862 (Missing Authorization). This flaw enables unauthorized creation and download of full-site backup archives. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts on confidentiality, integrity, and availability.

Authenticated attackers with Contributor-level access or higher can exploit this vulnerability remotely without user interaction. By accessing the affected REST API endpoints, they can generate and retrieve complete backup archives containing the entire WordPress installation, including database exports and sensitive configuration files. This grants attackers extensive access to site data, potentially facilitating data exfiltration, further compromise, or extortion.

Advisories and patch details are available via referenced sources, including WordPress plugin trac changeset 3449530, which addresses the issue, the FastDup code at line 371 in PackageApi.php, and the Wordfence threat intelligence report. Security practitioners should update the plugin beyond version 2.7.1 to mitigate the risk.