Backup Migration
Approved changes feed: RSS · Atom
cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Backupbliss (e3736e6e-97c2-5df6-bfd1-f100759cab8d) |
|---|---|
| Product | Backup Migration (e10f6322-740e-5a73-8581-198596988967) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-7002 |
vulnerable | 2026-06-08 06:21:56.576017 |
Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url
HIGH (7.2)
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
Published: 2023-12-23T01:59:51.281Z
Updated: 2026-04-08T17:23:43.101Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6972 |
vulnerable | 2026-06-08 06:21:56.505424 |
Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
CRITICAL (9.8)
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
Published: 2023-12-23T01:59:46.751Z
Updated: 2026-04-08T16:34:37.988Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6971 |
vulnerable | 2026-06-08 06:21:56.504744 |
Details available
HIGH (8.1)
The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.
Published: 2023-12-23T01:59:49.340Z
Updated: 2024-08-02T08:50:06.712Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6553 |
vulnerable | 2026-06-08 06:21:54.838916 |
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
CRITICAL (9.8)
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
Published: 2023-12-15T10:59:46.387Z
Updated: 2026-04-08T16:45:52.697Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6271 |
vulnerable | 2026-06-08 06:19:46.821476 |
Backup Migration Staging < 1.3.6 - Sensitive Data Exposure
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.
Published: 2024-01-01T14:18:55.067Z
Updated: 2025-06-11T16:41:10.999Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-6266 |
vulnerable | 2026-06-08 06:19:46.808528 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-3977 |
vulnerable | 2026-06-08 06:09:40.946284 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0958 |
vulnerable | 2026-06-08 05:52:33.526636 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-36884 |
vulnerable | 2026-06-08 05:32:52.658809 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.