CVE-2026-18216
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The Backup Migration WordPress plugin before version 2.1.7 does not properly restrict a post-restore automatic login mechanism. A user who administers one site of a multisite network can obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Risk Assessment
Risk of unauthorized access to administrative functions of other sites in a multisite network, potentially leading to full compromise of the WordPress environment.
Recommendation
Immediately update the Backup Migration plugin to version 2.1.7 or later and review session logs for unauthorized logins.
Original NVD description (English source)
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.