CVE-2026-1311 is a path traversal vulnerability (CWE-22) in the Worry Proof Backup plugin for WordPress, affecting all versions up to and including 0.2.4. The flaw exists in the backup upload feature, allowing authenticated users with low privileges (Subscriber and above) to upload ZIP archives containing path traversal sequences. This enables arbitrary file writes to any location on the server, including the placement of executable PHP files, which can lead to remote code execution. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated attacker with minimal privileges to write arbitrary files anywhere on the server, including executable code. This can lead to complete server compromise via remote code execution. The vulnerability affects confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or monitor user roles that have upload permissions in the Worry Proof Backup plugin. Consider disabling or removing the plugin if not essential. Avoid granting Subscriber-level or higher access to untrusted users.