CVE-2026-1104: 
WordPress vulnerability analysis and mitigation

CVE-2026-1104 is a Missing Authorization vulnerability in the FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress that allows authenticated attackers to create and download full-site backup archives without proper authorization. The flaw affects all versions of the plugin up to and including 2.7.1, and was published on February 12, 2026. It carries a CVSS v3.1 base score of 8.8 (High), reflecting low attack complexity and high impacts across confidentiality, integrity, and availability (Red Hat CVE, Wordfence).

The root cause is a missing capability check (CWE-862) on REST API endpoints exposed by the FastDup plugin. Because the plugin does not verify whether the requesting user has sufficient privileges to trigger backup operations, any authenticated user with Contributor-level access or above can call these endpoints directly. An attacker can craft REST API requests to initiate a full-site backup and subsequently download the resulting archive, which includes the entire WordPress file system, database exports, and configuration files such as wp-config.php (Red Hat CVE, Wordfence).

Successful exploitation grants an authenticated low-privileged attacker access to a complete backup of the WordPress installation, including database contents (user credentials, private data, posts), configuration files containing database credentials and secret keys, and all uploaded media and plugin/theme files. This exposure can enable credential harvesting, lateral movement to the underlying database server, and full site takeover. The high confidentiality, integrity, and availability impacts reflect the severity of exposing the entire site's data and infrastructure secrets (Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.037%, indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Qualys scanner (detection ID 530961) (Red Hat CVE, Wordfence).

1. Reconnaissance: Identify WordPress sites running the FastDup plugin (version ≤ 2.7.1) using passive techniques such as checking /wp-content/plugins/fastdup/ paths or plugin enumeration tools like WPScan.
2. Obtain Contributor-level access: Register or use an existing low-privileged account (Contributor role or above) on the target WordPress site.
3. Identify REST API endpoints: Review the FastDup plugin source code or documentation to identify the REST API routes responsible for backup creation (e.g., endpoints registered under /wp-json/fastdup/v1/).
4. Trigger backup creation: Send an authenticated REST API request (with a valid WordPress authentication nonce or cookie) to the backup creation endpoint, initiating a full-site backup.
5. Download the backup archive: Once the backup is generated, send a follow-up authenticated REST API request to the download endpoint to retrieve the full backup archive (.zip file containing the WordPress installation and database export).
6. Extract sensitive data: Open the downloaded archive to access wp-config.php (database credentials, secret keys), the database SQL dump (user hashes, content), and all site files for further exploitation (Red Hat CVE, Wordfence).

• Network: Unusual REST API requests to FastDup endpoints (e.g., /wp-json/fastdup/v1/backup or similar) originating from low-privileged user sessions; large outbound HTTP responses (multi-MB ZIP downloads) from the WordPress server to unexpected client IPs.
• Logs: WordPress access logs showing authenticated POST/GET requests to FastDup REST API routes from Contributor-level accounts; repeated or automated requests to backup and download endpoints in a short time window.
• File System: Presence of unexpected .zip backup archives in the WordPress installation directory or a FastDup-designated backup folder; new or recently modified backup files containing wp-config.php and SQL dumps.
• Process: Web server processes generating large archive files in the WordPress directory tree outside of normal scheduled backup windows.

No patched version of the FastDup plugin was confirmed available at the time of initial disclosure. Organizations should immediately consider disabling or removing the FastDup plugin until a patched version (above 2.7.1) is released and verified. As an interim measure, restrict Contributor-level and above account registrations to trusted users only, and implement network-level controls (e.g., WAF rules) to block unauthorized access to FastDup REST API endpoints. Monitor WordPress access logs for suspicious REST API activity and audit existing backup files for unauthorized access (Red Hat CVE, Wordfence).

Wordfence included CVE-2026-1104 in its weekly WordPress vulnerability report for the period of February 9–15, 2026, highlighting it as a notable missing authorization issue affecting the FastDup plugin (Wordfence). The vulnerability was also noted on Mastodon by security community accounts and picked up by aggregators such as RedPacket Security and VulDB shortly after disclosure. No major vendor statements or high-profile researcher commentary beyond standard aggregation have been observed.