WP BackItUp Community Edition

WP BackItUp Community Edition has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; 6 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 5.7, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high. 2024 was the busiest year with 4 disclosures.

The most common weakness is Missing Authorization, behind 4 of the records (50%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Cross-Site Request Forgery (CSRF).

6 of the records (75%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2026.

5 independent researchers contributed these findings, most of them (3) reported by Ananda Dhakal.

Strategic Overview

Avg CVSSMedium

5.7/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all WP BackItUp Community Edition vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2025-68039

BackItUp <= 2.1.0 - Missing Authorization

Read the full analysis

Vulnerability Records

8 records


2026-09-09 15:19	WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter WP BackItUp Community Edition <= 2.1.0	`CVE-2026-18386`	4.9 Medium	Nikola Kojic	No
2026-01-21 00:00	BackItUp <= 2.1.0 - Missing Authorization WP BackItUp Community Edition <= 2.1.0	`CVE-2025-68039`	5.3 Medium	Legion Hunter	No
2024-08-12 00:00	Backup and Restore WordPress <= 1.50 - Missing Authorization WP BackItUp Community Edition <= 1.50	`CVE-2024-43268`	4.3 Medium	Ananda Dhakal	Yes
2024-08-12 00:00	Backup and Restore WordPress <= 1.50 - Missing Authorization WP BackItUp Community Edition <= 1.50	`CVE-2024-43270`	5.3 Medium	Ananda Dhakal	Yes
2024-08-12 00:00	Backup and Restore Wordpress <= 1.50 - Cross-Site Request Forgery to Backup Trigger WP BackItUp Community Edition <= 1.50	`CVE-2024-43269`	6.5 Medium	Ananda Dhakal	Yes
2024-03-05 00:00	Backup and Restore WordPress WordPress <= 1.45 - Unauthenticated Information Exposure via Log Files WP BackItUp Community Edition <= 1.45	`CVE-2023-7232`	5.3 Medium	Dmitrii Ignatyev	Yes
2014-12-04 00:00	Backup and Restore WordPress – Backup Plugin <= 1.9 - Authorization Bypass WP BackItUp Community Edition <= 1.9	`N/A`	6.5 Medium	Kacper Szurek	Yes
2014-07-16 00:00	Backup and Restore WordPress – Backup Plugin <= 1.9 - Sensitive Information Disclosure WP BackItUp Community Edition <= 1.9	`CVE-2014-9012`	7.5 High	Kacper Szurek	Yes

Showing 1–8 of 8 reports