Security Alert Summary
The Keep Backup Daily plugin for WordPress contains a limited path traversal vulnerability in the kbd_open_upload_dir AJAX action. Insufficient validation of the kbd_path parameter can allow authenticated users with Administrator-level access to list the contents of directories outside the intended uploads directory. This affects all versions up to and including 2.1.1.
CVE Details
- CVE ID: CVE-2026-3339
- Affected plugin / component: Keep Backup Daily plugin for WordPress
- Affected versions: all versions up to and including 2.1.1
- Published: March 21, 2026 at 12:16:27 AM UTC
- Last modified: March 21, 2026 at 12:16:27 AM UTC
- CVSS v3.1: Base Score 2.7 (LOW) — Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
- Authentication / privileges / user interaction: Requires an authenticated user with high privileges (Administrator-level). User Interaction: None.
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE: CWE-22 (Path Traversal)
Technical Details
The vulnerability is a limited path traversal issue in the plugin’s AJAX handler kbd_open_upload_dir. The handler accepts a kbd_path parameter that is only passed through sanitize_text_field(). That sanitization function does not remove path traversal sequences (for example, “../”), so a crafted kbd_path can reference directories outside the intended uploads directory.
Because the handler can be invoked by authenticated users with Administrator-level privileges, an attacker with those privileges can list the contents of arbitrary directories on the server. The behavior described is an information disclosure issue consistent with the CVSS confidentiality impact of Low. The CVE description does not indicate modification or denial-of-service capability.
How This Could Impact Your Website
Consider a typical site with a site owner, internal staff (editors or contributors), and an external contractor who may have elevated permissions for maintenance. If an attacker gains or already holds Administrator-level access, they could call the vulnerable AJAX action to enumerate files and directories outside the uploads folder. That directory listing can reveal the presence and names of backups, configuration files, or other files that may contain sensitive data.
Practical consequences include exposure of internal user email addresses or other information stored in readable files, and an increased risk of targeted phishing or social engineering based on discovered filenames or structures. The issue is limited to disclosure rather than integrity or availability changes, according to the CVSS data.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with Administrator-level access.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected access to admin AJAX endpoints.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L855
- https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L871
- https://plugins.trac.wordpress.org/browser/keep-backup-daily/trunk/inc/functions.php#L855
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3481587%40keep-backup-daily&new=3481587%40keep-backup-daily&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/01984754-e332-4500-99a2-10a7b79967f5?source=cve
