CVE-2026-86827

{
  "etk_id": "ETK-2026-1355",
  "cve_id": "CVE-2026-86827",
  "display_id": "CVE-2026-86827",
  "ghsa_id": "GHSA-pcfw-vf4c-h2h5",
  "euvd_id": "EUVD-2026-94748",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated backup job triggering in BackWPup",
  "summary": "BackWPup versions before 5.7.7 can accept unauthenticated requests that start configured backup jobs outside their intended schedules. An attacker can cause an existing backup job to run immediately when the affected plugin and a backup job are present.",
  "mitigation": "Upgrade BackWPup to version 5.7.7 or later. Review configured backup jobs and monitor for unexpected backup executions after updating.",
  "vendor": null,
  "product": "BackWPup",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.3, < 5.7.7"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "5.7.7"
      ],
      "package_name": "BackWPup",
      "purl": null
    }
  ],
  "cwes": [
    862
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": 0.0022,
  "epss_percentile": 0.1152,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 35.48041331666667,
  "t0_at": "2026-10-08T06:00:08.008000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T13:06:19.076213+00:00",
      "days": 4.295961437650463,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:08.008000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-08T06:00:08.008000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:08.008000+00:00",
      "url": "https://github.com/advisories/GHSA-pcfw-vf4c-h2h5"
    }
  }
}