CVE-2026-1311

High

Published: 26 February 2026

Published

26 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0014 34.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1311 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 34.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Implements input validation mechanisms on ZIP archive uploads to reject path traversal sequences, directly preventing arbitrary file writes to server locations.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of the path traversal flaw in the backup upload functionality of the Worry Proof Backup plugin.

AC-6 Least Privilege partial match

prevent

Enforces least privilege to restrict backup upload functionality to roles above Subscriber-level, blocking exploitation by low-privilege authenticated users.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Path traversal in WordPress plugin enables low-priv authenticated attackers to write arbitrary files for RCE, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a…

malicious ZIP archive with path traversal sequences to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution.

Deeper analysisAI

CVE-2026-1311 is a Path Traversal vulnerability (CWE-22) in the Worry Proof Backup plugin for WordPress, affecting all versions up to and including 0.2.4. The flaw exists in the backup upload functionality, enabling improper handling of ZIP archives. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-26T05:17:41.933.

Authenticated attackers with Subscriber-level access or higher can exploit the vulnerability by uploading a malicious ZIP archive containing path traversal sequences. This allows them to write arbitrary files to any location on the server, including executable PHP files, which can result in remote code execution.

Advisories reference the vulnerable code in the plugin's inc/libs/upload-backup.php file at line 97, as shown in the 0.2.4 tag and trunk versions on the WordPress plugins trac, along with a Wordfence threat intelligence page (ID: 3ffd6ce0-2536-43a5-9925-438bc653d0e5). No specific patch or mitigation details are outlined in the provided references.