What the vulnerability does
01Description
The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.
Explanation of Vulnerability in Simple Terms
02Summary
Keep Backup Daily versions up to 2.1.1 contain a path traversal vulnerability that allows high-privilege users to read files outside the intended backup directory. An attacker with administrative access can craft requests to access sensitive files on the server. The vulnerability has low confidentiality impact and requires high privileges to exploit.
What an attacker can do
03Attacker Capabilities
Read arbitrary files from the server outside the backup directory.
Potential impact on your site
04Site Impact
Administrators with malicious intent or compromised admin accounts could access sensitive server files.
Conditions required to exploit
05Prerequisites
Attacker must have high-level administrative privileges on the site.
Key dates
06Disclosure timeline
March 20, 2026
CVE published
April 8, 2026
Record updated
