CVE-2026-39480
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Backup Migration versions up to 2.1.1 have a vulnerability that allows unauthorized access to sensitive data.
Risk Assessment
Organizations may be exposed to leaks of confidential information, which can lead to serious legal and reputational consequences.
Recommendation
It is recommended to upgrade to the latest version of Backup Migration to mitigate this vulnerability.
Other vulnerabilities in Backup Migration
See all- CVE-2026-7693High
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to 2.1.5.1 due to insufficient sanitization of the 'file' POST parameter on the restoreBackup() AJAX handler. Authenticated attackers with Administrator-level access can execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants.
- CVE-2025-14944Medium
The Backup Migration plugin for WordPress up to version 2.0.0 has a missing authorization in the initializeOfflineAjax function and lacks nonce verification. The endpoint only validates hardcoded tokens publicly exposed in the plugin's JavaScript, allowing unauthenticated attackers to trigger backup upload queue processing, potentially causing unexpected transfers to configured cloud storage targets and resource exhaustion.
Original NVD description (English source)
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS