CVE-2026-1311: 
WordPress vulnerability analysis and mitigation

CVE-2026-1311 is a Path Traversal vulnerability in the Worry Proof Backup plugin for WordPress, affecting all versions up to and including 0.2.4. The flaw exists in the backup upload functionality and allows authenticated attackers with Subscriber-level access or above to upload a malicious ZIP archive containing path traversal sequences, enabling arbitrary file writes — including executable PHP files — anywhere on the server, which can lead to remote code execution. It was published on February 26, 2026, with the CVE assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — 'Path Traversal'). The root cause lies in insufficient validation of file paths within uploaded ZIP archives in the plugin's backup upload handler (inc/libs/upload-backup.php, around line 97), which fails to sanitize or restrict path traversal sequences (e.g., ../) embedded in archive entry names. An authenticated attacker with at minimum Subscriber-level WordPress credentials can craft a ZIP file where internal file paths traverse outside the intended upload directory, writing arbitrary content — including PHP webshells — to any location writable by the web server process. No user interaction beyond authentication is required, and the attack is conducted entirely over the network (Wordfence, WordPress Trac).

Successful exploitation grants an attacker the ability to write arbitrary files — including PHP webshells — to any server-accessible directory, resulting in full remote code execution. This yields high confidentiality impact (access to sensitive files, credentials, and database contents), high integrity impact (modification or deletion of files and application data), and high availability impact (potential to disrupt or destroy the WordPress installation or underlying server). Given the low privilege requirement (Subscriber-level), the attack surface is broad on any WordPress site with open user registration, and successful exploitation could serve as a foothold for lateral movement within the hosting environment (Wordfence, Red Hat CVE).

A public proof-of-concept exploit has been published on GitHub (GitHub PoC), though there is no confirmed evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.255%, indicating a currently low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low privilege requirement (Subscriber-level) makes this vulnerability particularly accessible on sites with open registration (Wordfence, GitHub PoC).

1. Reconnaissance: Identify WordPress sites running the Worry Proof Backup plugin (version ≤ 0.2.4) using tools like WPScan, Shodan, or by checking /wp-content/plugins/worry-proof-backup/ for plugin presence.
2. Obtain Subscriber-level access: Register a standard WordPress user account on the target site (if open registration is enabled), or use compromised low-privilege credentials.
3. Craft malicious ZIP archive: Create a ZIP file containing a PHP webshell with a path traversal sequence in the archive entry name (e.g., ../../../../wp-content/uploads/shell.php) so that extraction places the file outside the intended backup directory.
4. Upload the malicious ZIP: Authenticate to WordPress and use the Worry Proof Backup plugin's backup upload functionality to submit the crafted ZIP archive. The plugin's upload-backup.php handler extracts the archive without adequately validating entry paths.
5. Trigger remote code execution: Access the dropped PHP file via the web server (e.g., https://target.com/wp-content/uploads/shell.php?cmd=id) to execute arbitrary commands on the server as the web server process user (Wordfence, WordPress Trac, GitHub PoC).

• Network: Authenticated POST requests to WordPress endpoints associated with the Worry Proof Backup plugin's upload functionality (e.g., wp-admin/admin-ajax.php or plugin-specific upload URLs) containing ZIP file uploads from low-privilege user accounts; outbound connections from the web server to unknown external IPs following a file upload event.
• File System: Unexpected PHP files (e.g., webshells) appearing in directories such as wp-content/uploads/, wp-content/themes/, or the WordPress root, especially files with names inconsistent with normal WordPress operation; ZIP archives containing entries with ../ sequences in upload/temp directories.
• Logs: Web server access logs showing POST requests to backup upload endpoints from Subscriber-level user sessions, followed shortly by GET requests to newly created PHP files in unexpected directories; PHP error logs referencing file extraction operations outside the plugin's designated directory.
• Process: Unusual child processes spawned by the web server process (e.g., sh, bash, curl, wget, python) shortly after a backup upload event (Wordfence).

As of the time of disclosure, no patched version of the Worry Proof Backup plugin beyond 0.2.4 was confirmed available; administrators should check the WordPress plugin repository for updates and upgrade immediately if a newer version is released. As an interim workaround, the plugin should be deactivated and removed from WordPress installations until a fix is available. Additionally, restrict WordPress user registration to prevent unauthorized Subscriber-level account creation, and configure web server permissions to limit write access to sensitive directories. Monitor web server logs for suspicious file upload activity and unexpected PHP file creation in non-standard directories (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability intelligence report for the period of February 23 – March 1, 2026, and published a dedicated threat intelligence entry (Wordfence Weekly Report). RedPacket Security flagged the CVE on Mastodon and their website shortly after disclosure, contributing to broader community awareness (RedPacket Security). General community reaction has been moderate, consistent with a high-severity WordPress plugin vulnerability requiring low privileges, with aggregation across multiple vulnerability tracking platforms (VulDB, Vulners, CIRCL, ENISA EUVD).