CVE-2023-6972

🗓️ 23 Dec 2023 01:59:46Reported by WordfenceType

The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Path Traversal in Backupbliss Backup_Migration	13 Apr 202622:56	–	githubexploit
Circl	CVE-2023-6972	23 Dec 202303:22	–	circl
CNNVD	WordPress plugin Backup Migration security vulnerability	23 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-6972 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion	23 Dec 202301:59	–	cvelist
EUVD	EUVD-2023-59168	3 Oct 202520:07	–	euvd
NVD	CVE-2023-6972	23 Dec 202302:15	–	nvd
OpenVAS	WordPress Backup Migration Plugin < 1.4.0 Multiple Vulnerabilities	29 Dec 202300:00	–	openvas
OSV	CVE-2023-6972	23 Dec 202302:15	–	osv
Patchstack	WordPress Backup Migration Plugin <= 1.3.9 is vulnerable to Path Traversal	27 Dec 202300:00	–	patchstack
Prion	Path traversal	23 Dec 202302:15	–	prion

NVD

Vulners

Node

backupbliss backup_migrationRange<1.4.0wordpress

[
  {
    "vendor": "inisev",
    "product": "BackupBliss – Backup & Migration with Free Cloud Storage",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.3.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3012745/backup-backup
plugins	www.plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/0a3ae696-f67d-4ed2-b307-d2f36b6f188c
plugins	www.plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/bypasser.php

08 Apr 2026 17:17Current

9.7High risk

Vulners AI Score9.7

CVSS 3.19.8

EPSS0.1832

CWE-22