What is the CVSS score of CVE-2026-39480?

CVE-2026-39480 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Backup Migration are affected by CVE-2026-39480?

The Inisev Backup Migration WordPress plugin (versions through 2.1.1) contains an unauthenticated vulnerability that exposes sensitive backup data to unauthorized remote access.

How to fix or mitigate CVE-2026-39480?

Within 24 hours: Identify all WordPress sites using Inisev Backup Migration plugin versions ≤2.1.1 and disable the plugin to block exploitation. Within 7 days: Completely remove the plugin from all installations and audit backup files for unauthorized access indicators or data exfiltration. Within 30 days: Implement alternative backup solution with verified security controls and establish monitoring for exploitation attempts in web logs.

Backup Migration CVE-2026-39480

EUVD-2026-36939 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-15 Patchstack

GHSA-fw7p-pwjh-7j6x

Information Disclosure Backup Migration

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint discloses sensitive backup/config data (AV:N, AC:L, PR:N, UI:N); confidentiality-only impact with no integrity or availability effect (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:28 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Inisev Backup Migration WordPress plugin (versions through 2.1.1) allows remote attackers to retrieve confidential information without credentials or user interaction. Patchstack rates the issue at CVSS 7.5 with high confidentiality impact; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Backup Migration is a WordPress plugin by Inisev (CPE cpe:2.3:a:inisev:backup_migration) used to create and restore site backups, which means it routinely handles archives containing database dumps, wp-config.php credentials, salts, and uploaded files. The flaw is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), indicating that the plugin emits sensitive content over an output channel - typically an HTTP response, log, or downloadable artifact - to a requester who should not receive it. Combined with the unauthenticated CVSS vector, this points to a plugin endpoint, REST route, or backup storage location that is reachable over the network without proper access checks.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/backup-backup/vulnerability/wordpress-backup-migration-plugin-2-1-1-sensitive-data-exposure-vulnerability) for the fixed version once published and upgrade Backup Migration beyond 2.1.1 as soon as it is available. In the interim, deactivate and remove the Backup Migration plugin on internet-facing WordPress sites that do not actively need it (trade-off: loss of scheduled backup automation - replace with a server-side backup such as wp-cli db export via cron, or a different maintained plugin), or place the WordPress admin and wp-content/plugins/backup-backup/ paths behind IP allowlisting or HTTP Basic auth at the web server / WAF layer (trade-off: blocks legitimate remote admin access from unlisted networks). Additionally, rotate any secrets that may already have been exposed - wp-config.php database credentials, AUTH/SECURE_AUTH/LOGGED_IN/NONCE keys and salts, and any API tokens stored in options - since CWE-201 disclosures are not retroactively contained by patching alone.