Backup Migration CVE-2026-39480

No special conditions - remote unauthenticated exploitation against default configurations of the Inisev Backup Migration WordPress plugin at versions ≤ 2.1.1, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:N. Practical limits on exploitation are that the target WordPress site must have the Backup Migration plugin installed and activated and the vulnerable endpoint or backup storage path must be reachable from the attacker's network (i.e., not blocked by an upstream WAF, IP allowlist, or HTTP auth in front of wp-content/plugins/backup-backup/); the specific endpoint that triggers the disclosure is not detailed in the supplied data and should be confirmed against the Patchstack advisory.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates a network-reachable, low-complexity, unauthenticated read primitive with high confidentiality impact and no integrity or availability effect - a profile that is straightforward to weaponize at scale against internet-exposed WordPress sites once an endpoint is identified. There is no public exploit identified at time of analysis and the CVE is not present in CISA KEV, and no EPSS score, SSVC decision, or PoC indicator was supplied in the input. Real-world risk is meaningful because confidentiality impact on a backup plugin typically translates to disclosure of database dumps and wp-config secrets, but priority should be tempered by the fact that exploitation activity is not yet confirmed; treat as high-priority patch-when-able rather than emergency until a PoC or KEV listing appears.

An attacker enumerates WordPress sites running the Backup Migration plugin (e.g., via the readme.txt fingerprint under /wp-content/plugins/backup-backup/) and issues an unauthenticated HTTP request to the vulnerable plugin endpoint or backup storage location, receiving sensitive data such as configuration values, database contents, or backup archive metadata in the response. The disclosed material - particularly wp-config.php credentials or database dumps - is then used to pivot to full site takeover by logging in as an administrator or connecting directly to the database. No public exploit identified at time of analysis, but the AC:L/PR:N/UI:N profile makes scripted mass scanning trivial once an endpoint is identified.