CVE-2026-101148

Summary

The flaw allows unauthenticated attackers to create and download full site backups, including sensitive data, and delete arbitrary files, leading to potential data disclosure and site takeover.

Exploitability

Exploitation is relatively easy as it requires no authentication and can be automated, but attackers must have access to the integration key or be able to unset it.

Blast radius

If exploited, the impact is high, as it can lead to sensitive data disclosure and complete site compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Remove the BackupSheep WordPress Backup Plugin from any site where it is installed.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.