CVE-2026-3339 is a CWE-22 path traversal vulnerability in the Keep Backup Daily WordPress plugin by fahadmahmood. The issue exists in all versions up to 2.1.1 due to inadequate validation of the kbd_path parameter in the kbd_open_upload_dir AJAX action. The parameter is sanitized only with sanitize_text_field(), which does not remove path traversal sequences, enabling authenticated users with administrator privileges to list contents of arbitrary directories on the server outside the intended upload directory.

An attacker with administrator-level access can exploit this vulnerability to enumerate directory contents outside the plugin's upload directory. The CVSS score of 2.7 reflects low confidentiality impact with no impact on integrity or availability. There are no known exploits in the wild reported. The vulnerability requires high privileges (administrator) and no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to directory listing. Avoid exposing the vulnerable AJAX action if possible through plugin configuration or web application firewall rules.