CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 fails to restrict its post-restore auto-login mechanism in multisite deployments. A site admin can trigger a restore on another site in the network, obtaining a long-lived admin session without credentials and bypassing 2FA. CISA flags it as expl...