CVE-2026-1311
Published: 26 February 2026
Summary
CVE-2026-1311 is a high-severity Path Traversal (CWE-22) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-1311 is a Path Traversal vulnerability (CWE-22) in the Worry Proof Backup plugin for WordPress, affecting all versions up to and including 0.2.4. The flaw exists in the backup upload functionality, enabling improper handling of ZIP archives. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-02-26T05:17:41.933.
Authenticated attackers with Subscriber-level access or higher can exploit the vulnerability by uploading a malicious ZIP archive containing path traversal sequences. This allows them to write arbitrary files to any location on the server, including executable PHP files, which can result in remote code execution.
Advisories reference the vulnerable code in the plugin's inc/libs/upload-backup.php file at line 97, as shown in the 0.2.4 tag and trunk versions on the WordPress plugins trac, along with a Wordfence threat intelligence page (ID: 3ffd6ce0-2536-43a5-9925-438bc653d0e5). No specific patch or mitigation details are outlined in the provided references.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8833
Vulnerability details
The Worry Proof Backup plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.2.4 via the backup upload functionality. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload a…
more
malicious ZIP archive with path traversal sequences to write arbitrary files anywhere on the server, including executable PHP files. This can lead to remote code execution.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in WordPress plugin enables low-priv authenticated attackers to write arbitrary files for RCE, directly facilitating T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Implements input validation mechanisms on ZIP archive uploads to reject path traversal sequences, directly preventing arbitrary file writes to server locations.
Requires timely identification, reporting, and correction of the path traversal flaw in the backup upload functionality of the Worry Proof Backup plugin.
Enforces least privilege to restrict backup upload functionality to roles above Subscriber-level, blocking exploitation by low-privilege authenticated users.