WXD Backup Lite
WXD Backup Lite has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for WXD Backup Lite has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Ananda Dhakal. The current release is tested up to WordPress 7.0.7.
CVE-2026-41560WXD Backup Lite <= 1.0.2 - Missing Authorization
Read the full analysisVulnerability Records

WXD Backup Lite
Author
wxdlabs
Most WordPress backup tools either feel too fragile when you actually need them, or too bloated with upsells and clutter. WXD Backup Lite is built around a narrower goal: reliable backups, safer restores, and cleaner migrations for real-world WordPress sites. The focus is on recovery confidence and predictable workflows — not features for their own sake. Full-site backups. Guided restores. Clean migrations. WXD Backup Lite can create full-site or selective backups, schedule recurring jobs, enforce retention rules, lock important backups from deletion, and guide restores through a structured flow — including an automatic restore point created before every recovery attempt. WooCommerce-friendly: Because WooCommerce stores everything in the WordPress database and filesystem, full-site backups automatically capture orders, products, customers, and store configuration. No extra setup required. What’s included: Full-site backup — database, plugins, themes, uploads, MU-plugins, and core files Selective backup scope for targeted jobs Portable .zip backup archives Daily, weekly, or manual backup scheduling Configurable retention with automatic cleanup of the oldest backups Backup locking to protect important archives from auto-deletion Guided one-click restore with scope selection, confirmation, and real-time progress Automatic restore point created before every restore Real-time restore event log and progress tracking Post-restore validation flow Site migration workflow with URL rewriting wp-config.php normalization after migration Import from an uploaded backup archive Dashboard with backup stats, storage forecast, and server health check Activity log with export support Concurrent restore lock and restore-safety protections Nonce and capability protection on all AJAX actions Note: This plugin does not support WordPress Multisite. It is designed for single-site installs only. Privacy: No data leaves your server. WXD Backup Lite makes no external API calls, does not phone home, and requires no account or license key. Backup archives are stored locally in the wsbl-backups subfolder of your WordPress uploads directory.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C