Unknown Backup Migration vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown Backup Migration, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2025-12394unknown · backup migration +1 moreBackup Migration < 2.0.0 - Unauthenticated Backup DownloadThe Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.EPSS0.28%MediumCVE-2026-18216unknown · backup migration +1 moreBackup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-LoginThe Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.EPSS0.51%CriticalCVE-2023-6271backupbliss · backup_migration +2 moreBackup Migration Staging < 1.3.6 - Sensitive Data ExposureThe Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.EPSS0.69%