Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive `str_replace()` sanitization of path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to include arbitrary PHP files on the server via crafted traversal sequences (e.g., `....//`), which can be leveraged to read sensitive files such as `wp-config.php` or achieve remote code execution in certain configurations. Administrators have the ability to grant individual users permission to handle backups, which may then allow lower-level users to exploit this vulnerability.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-14 | 2 | Disclosure2 |
| 2026-04-15 | 1 | Disclosure1 |
⚡ New CVE Alert: CVE-2026-6227 📊 Severity: 7.2 🚨 Risk Level: High 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-6227 #CVE-2026-6227 #CVE #High #Wordpress #CyberSecurity #InfoSec https://t.co/iH89BPxOyO
Post summary
The tweet provides a basic disclosure of CVE‑2026‑6227 with severity and affected product information, but offers no technical details, PoC, or exploitation context.
CVE-2026-6227 The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versi… https://www.cve.org/CVERecord?id=CVE-2026-6227
Post summary
The text announces CVE‑2026‑6227, highlighting a Local File Inclusion vulnerability in the BackWPup WordPress plugin, but contains no exploit, PoC, or mitigation details.
⚠️ HIGH — CVE-2026-6227 The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json… CVSS 7.2 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6227 #WordPress #CyberSecurity #InfoSec
Post summary
The post announces a high-severity CVE-2026-6227 affecting the BackWPup WordPress plugin, detailing it as a Local File Inclusion with a CVSS of 7.2 and linking to a full analysis.