Attack Vectors

FastDup – Fastest WordPress Migration & Duplicator (slug: fastdup) in versions 2.7.1 and earlier has a High-severity vulnerability (CVSS 8.8, CVE-2026-1104) that can be exploited by an attacker who already has an authenticated WordPress account with Contributor-level access or higher.

The issue centers on REST API endpoints that allow unauthorized backup creation and download. In practical terms, a low-privileged internal user, compromised contributor account, or a third-party account with limited access could potentially trigger the plugin to generate a full-site backup archive and then download it—without the intended authorization safeguards.

Security Weakness

The vulnerability is caused by a missing capability (authorization) check on specific REST API endpoints in FastDup. Because the endpoints do not properly enforce who is allowed to create and retrieve backups, authenticated users who should not have backup privileges may be able to use the functionality anyway.

Backups are especially sensitive because they can include the entire WordPress installation, including database exports and configuration files. When access controls fail around this type of data, the result is often a rapid escalation from “limited site access” to “full environment exposure.”

Technical or Business Impacts

This is a High business-risk issue because successful exploitation can expose a complete snapshot of your website and its underlying data. That may include customer or prospect information, internal content, configuration secrets, and other data that directly affects brand trust and operational continuity.

Key outcomes can include data breach exposure, credential and configuration leakage, and the ability for attackers to re-create or manipulate your site environment offline. For marketing and executive stakeholders, the downstream risks typically show up as incident response costs, potential compliance reporting obligations, campaign downtime, reputational harm, and a heightened likelihood of follow-on attacks using information extracted from the backup.

Remediation: Update FastDup – Fastest WordPress Migration & Duplicator to version 2.7.2 or newer (patched). Source: Wordfence vulnerability record.

Similar Attacks

Attackers frequently target WordPress sites by abusing plugin authorization gaps and exposed backup mechanisms. Real-world incidents and reporting that highlight the business impact of WordPress compromises include:

U.S. Department of Justice: Cybercrime scheme targeting WordPress sites

Wordfence Blog: Ongoing reporting on exploited WordPress plugin vulnerabilities