VulnSocial

CVE-2026-101148

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover. The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-73

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-01: 110-01
Full discourse1 post
  • Upwind Security MDR@UpwindMDR

    🚨Critical - BackupSheep Unauth Backup Download + Arbitrary File Delete (CVE-2026-101148) BackupSheep WordPress Backup Plugin <=1.8 fails to validate the integration key, treating a blank/unset key as valid. Unauthenticated attackers can hit the plugin’s backup/export endpoints to generate/download full site backups (incl. DB + password hashes) and invoke file delete actions, enabling data theft and potential takeover. 👉Affected: BackupSheep WordPress Backup Plugin <= 1.8

    0000059
    308 followersView on X

Explore more

Back to dashboard