CVE-2023-5504 is a high severity (CVSS 8.7) directory traversal flaw in the BackWPup plugin for WordPress, versions up to and including 4.0.1. An authenticated attacker can store backups in arbitrary writable folders. Update to a release after 4.0.1 and confirm the fixed version in the changelog.
What's affected
- Plugin: BackWPup for WordPress, published by Inpsyde.
- Affected: all versions up to and including 4.0.1.
- Fixed version: not stated in the NVD record, and the plugin repository and Wordfence pages could not be read during this review. Check the BackWPup changelog for the first release after 4.0.1.
- Severity: 8.7 High in the NVD record.
- Privilege needed: an authenticated account that can change backup settings.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under BackWPup. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for BackWPup and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. BackWPup is often installed on shared hosting, so check every site on the account.
A version of 4.0.1 or lower is in the affected range. Also open the BackWPup settings and note the Log File Folder and backup folder paths. A path that points outside the plugin's expected area, or into another site's directory, is worth a closer look.
What to do now
- Update BackWPup to the latest release and confirm in the changelog that it is later than 4.0.1.
- Review the configured log folder and backup destination paths in each job and in the general settings. Reset anything that points somewhere unexpected.
- Check which users hold roles that can change plugin settings, and remove access that is not needed.
- On shared hosting, confirm that no other site on the account has its root folder listed as a backup destination.
- Keep offsite backups of your own, and confirm a restore works after the update.
Why it matters
The record says the plugin accepts a Log File Folder value without confining it to a safe location. That is CWE-22, path traversal: user input decides which file system location is used. Here the effect is on where backups are written, and the plugin is meant to place an index.php and a .htaccess file in the chosen folder to stop directory listing.
That protective behavior is what makes the shared hosting case interesting. The record notes that an attacker could point the backup directory at the root of another site in a shared environment, and the files the plugin drops there could disable that site. A backup plugin has wide file system access by design, so small flaws in path handling carry more weight than in most plugins. The record does not list this CVE as known exploited.
Quick check
Do I need to worry if only administrators can use the plugin?
The attacker has to be authenticated, so the risk grows with the number of accounts that can reach the settings. Sites with many editors or shared admin accounts have more exposure than a single owner site.
Sources
Last reviewed: 19 October 2026.
