HomeWordPress vulnerabilitiesBackup Migration
Backup Migration vulnerabilities
Backup Migration has 14 known vulnerabilities in this database. The most recent published record is dated 15 Aug 2026.
- Known vulnerabilities
- 14
- Active installs
- 80,000+
- Latest version
- 2.1.7
- Last updated
- 11 Aug 2026
- Most recent
- 15 Aug 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Authentication bypass CVE-2026-18216 | Medium 6.5 | Before 2.1.7 | Fixed in 2.1.7 | 15 Aug 2026 |
| Remote code execution CVE-2026-7693 | High 7.2 | Up to 2.1.5.1 | Fixed in a later version (latest 2.1.7) | 5 Aug 2026 |
| Broken access control CVE-2025-14944 | Medium 5.3 | Up to 2.0.0 | Fixed in a later version (latest 2.1.7) | 7 Apr 2026 |
| Security weakness CVE-2025-12394 | Medium 5.9 | Before 2.0.0 | Fixed in 2.0.0 | 24 Nov 2025 |
| PHP object injection CVE-2024-10932 | High 8.8 | Up to 1.4.6 | Fixed in a later version (latest 2.1.7) | 4 Jan 2025 |
| Broken access control CVE-2023-6266 | High 7.5 | Up to 1.3.6 | Fixed in a later version (latest 2.1.7) | 11 Jan 2024 |
| Security weakness CVE-2023-6271 | High 7.5 | Before 1.3.6 | Fixed in 1.3.6 | 1 Jan 2024 |
| File inclusion CVE-2023-6971 | High 8.1 | Before 1.4.0 | Fixed in 1.4.0 | 23 Dec 2023 |
| Remote code execution CVE-2023-6972 | Critical 9.8 | Before 1.4.0 | Fixed in 1.4.0 | 23 Dec 2023 |
| Remote code execution CVE-2023-7002 | High 7.2 | Before 1.4.0 | Fixed in 1.4.0 | 23 Dec 2023 |
| Remote code execution CVE-2023-6553 | Critical 9.8 | Up to 1.3.7 | Fixed in a later version (latest 2.1.7) | 15 Dec 2023 |
| Cross-site request forgery (CSRF) CVE-2023-3977 | Medium 4.3 | Before 3.5.8 | Fixed in 3.5.8 | 28 Jul 2023 |
| Broken access control CVE-2023-0958 | Medium 4.3 | Before 2.8.2 | Fixed in 2.8.2 | 28 Jul 2023 |
| Cross-site scripting (XSS) CVE-2021-36884 | Medium 4.8 | Up to 1.1.5 | Fixed in a later version (latest 2.1.7) | 19 Nov 2021 |
Read the published descriptions
- CVE-2026-18216, 15 Aug 2026
- The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication. CVE record
- CVE-2026-7693, 5 Aug 2026
- The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` - an HTML-context sanitizer that does not strip shell metacharacters - and concatenates the result, unquoted, into a `php-cli -f … bmi_restore <file> <remote>` command passed to `exec()`. This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's `do_backups` capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the `$_POST['url']` path of `handleQuickMigration()`; the equivalent mitigations (`rawurlencode()` + explicit shell-metachar replacement + double-quoting in `exec()`) were never applied to `$backupName`. CVE record
- CVE-2025-14944, 7 Apr 2026
- The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion. CVE record
- CVE-2025-12394, 24 Nov 2025
- The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication. CVE record
- CVE-2024-10932, 4 Jan 2025
- The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit. CVE record
- CVE-2023-6266, 11 Jan 2024
- The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more. CVE record
- CVE-2023-6271, 1 Jan 2024
- The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups. CVE record
- CVE-2023-6971, 23 Dec 2023
- The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP. CVE record
- CVE-2023-6972, 23 Dec 2023
- The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible. CVE record
- CVE-2023-7002, 23 Dec 2023
- The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system. CVE record
- CVE-2023-6553, 15 Dec 2023
- The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server. CVE record
- CVE-2023-3977, 28 Jul 2023
- Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. CVE record
- CVE-2023-0958, 28 Jul 2023
- Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability. CVE record
- CVE-2021-36884, 19 Nov 2021
- Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions. CVE record
What to do if you run Backup Migration
If you run Backup Migration, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Backup Migration vulnerabilities
Free. We email you when a new vulnerability is published for Backup Migration, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.