CVE-2023-6553

2023-12-1511:15:47

[email protected]

web.nvd.nist.gov

wordpress

backup migration plugin

cve-2023-6553

rce

vulnerability

nvd

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.919 High

EPSS

Percentile

98.9%

JSON

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

Affected configurations

Vulners

NVD

Node

migratebackup_migrationRange≤1.3.7

CPENameOperatorVersion
backupbliss:backup_migrationbackupbliss backup migrationle1.3.7

CPE	Name	Operator	Version
backupbliss:backup_migration	backupbliss backup migration	le	1.3.7

CNA Affected

[
  {
    "vendor": "migrate",
    "product": "Backup Migration",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.3.7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]