Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

BackupSheep plugin allows anyone to delete files and steal backups

CVE-2026-101148 · published 18 days ago
Summary

The BackupSheep WordPress backup plugin (up to version 1.8) does not check its integration key, so anyone on the internet can make a full site backup and download it, including user password hashes, and can also delete any file on the server. This can lead to loss of data and full control of the site. No patched version is available; the safest action is to uninstall the plugin from all WordPress sites immediately.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
unknown backupsheep wordpress backup plugin <= 1.8
Original advisory text
BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to delete arbitrary files on the server, leading to sensitive data disclosure and site takeover.

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 has been closed on WordPress.org since July 2024 and no fixed version is available. Remove it from any site where it is installed.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-73External Control of File Name or Path
Timeline
Published1 Oct 2026
Updated15 Oct 2026
First seen1 Oct 2026
Sources
CVE-2026-101148 · NVD
CVE-2026-101148 · MITRE
Track software like this
Free during beta