WordPress Backup Migration <= 1.3.6 - Path Traversal

WordPress Backup Migration plugin versions up to 1.3.6 contain a path traversal and file validation issue in handledownloading function, letting unauthenticated attackers download backup files containing sensitive information. id: CVE-2023-6266 info: name: WordPress Backup Migration = 1.3.6 - Pat...

CVE-2023-6553

CVE-2023-6553 Due to a incorrect include statement in the "Backup Migration" plugin, a attacker can achieve RCE Summary of the CVE The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file...

CVE-2025-5961

CVE-2025-5961 Migration, Backup, Staging – WPvivid Backup & Migration 1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo validlft forever preferredlft forever inet6 ::1/128 scope host validlft...

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

CVE-2026-1357

CVE-2026-1357 — WPvivid Backup & Migration ≤ 0.9.123 Unauthenticated Arbitrary File Upload → RCE PoC for CVE-2026-1357 CVSS 9.8 Critical, CWE-434: an unauthenticated arbitrary file upload in the WPvivid Backup & Migration plugin for WordPress that leads to remote code execution. Fixed in 0.9.124...

CVE-2023-6553

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup Migration Plugin Plugin: Backup Migration backup-backup ≤ 1.3.7 CVSS: 9.8 Critical CWE: CWE-98 — Improper Control of Filename for Include/Require Statement Authentication Requirement: None Impact: Remote Code Execution 1. What is this...

EUVD-2026-75532

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...

WordPress_Backup_Migration-RCE_Unauthenticated

CVE-2023-6553 — El plugin Backup Migration para WordPress - Shell reversa Una versión extendida del exploit CVE-2023-6553 de Chocapikk que añade un modo de shell reversa con un solo comando sobre la webshell interactiva original. Vulnerabilidad CVE-2023-6553 — Ejecución remota de código no...

CVE-2023-6553-PoC

CVE-2023-6553 PoC LFI to RCE Ejecución remota de código no autenticada en Backup Migration plugin de WordPress. Ejecución root@kitploit: $ python exploit.py Se ejecuta el siguiente script PHP. root@kitploit: out.txt; ? Referencias Ejecución remota de código no autenticada crítica encontrada en el...

CVE-2023-6972-Exploit-Arbitrary-File-Deletion

CVE-2023-6972 Prueba de Concepto PoC Descripción Este repositorio contiene una prueba de concepto PoC del exploit para CVE-2023-6972. La vulnerabilidad permite la eliminación arbitraria de archivos sin autenticación AFD en el plugin de migración de respaldo de Wordpress Nota: Un análisis técnico...

CVE-2023-6553-RCE-Exploit

🔥 CVE-2023-6553 — WordPress Backup Migration RCE Unauthenticated Remote Code Execution via PHP Filter Chain Proof of Concept exploit for CVE-2023-6553 — a critical unauthenticated RCE vulnerability in the WordPress "Backup Migration" plugin versions ≤ 1.3.7. 📋 Vulnerability Overview...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.134 - Admin+ Arbitrary File Deletion vulnerability

Admin+ Arbitrary File Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin WPvivid Backup and Migration versions 0.9.134...

WordPress WPvivid — Backup, Migration & Staging plugin < 0.9.133 - Admin+ Arbitrary File Write vulnerability

Admin+ Arbitrary File Write vulnerability discovered by Nir Yehoshua in WordPress Plugin WPvivid Backup and Migration versions 0.9.133...

CVE-2026-19722 WPvivid Backup & Migration < 0.9.133 - Admin+ Arbitrary File Write via Zip Slip in Backup Restore

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can...

EUVD-2026-59918

The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...

EUVD-2026-59591

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...

CVE-2026-18216 Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without...

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 fails to restrict its post-restore auto-login mechanism in multisite deployments. A site admin can trigger a restore on another site in the network, obtaining a long-lived admin session without credentials and bypassing 2FA. CISA flags it as expl...

The vulnerability of the openssl_private_decrypt() function in the WPvivid Backup & Migration plugin of the WordPress content management system allows for the execution of arbitrary code and gives full control over the website.

The vulnerability of the opensslprivatedecrypt function in the WPvivid Backup & Migration plugin of the WordPress content management system is related to the ability to download unlimited files of a dangerous type. Exploiting this vulnerability allows an attacker, operating remotely, to execute...