Read the docs
TI-2023-06373 Aliases CVE-2023-6971GHSA-4vhp-8vcj-r74x

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in…

Priority MEDIUM 51CWE-829Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-829.

Summary

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

Why it matters now

EPSS 0.06419 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
migrateBackup Migration1.0.8 – 1.3.9—No fix listedCNA
  • Backup Migration Vendormigrate Affected 1.0.8 – 1.3.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*1.0.8 to before 1.4.0Vulnerablemigrate
  • cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:* Versions 1.0.8 to before 1.4.0 Vulnerable ·migrate

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6971
  2. 2026-10-03 Alias added: GHSA-4vhp-8vcj-r74x

References

Patch 3

  • TI-2023-06004 Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution CVSS 3.1CRITICAL 9.8
  • TI-2023-05759 Backup Migration Staging < 1.3.6 - Sensitive Data Exposure CVSS 3.1HIGH 7.5
  • TI-2023-06399 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url CVSS 3.1HIGH 7.2
  • TI-2023-06374 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion CVSS 3.1CRITICAL 9.8
  • TI-2023-05754 Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure CVSS 3.1HIGH 7.5
  • TI-2023-00909 Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function CVSS 3.1MEDIUM 6.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences