Backupbliss vulnerabilities

Products

• backup migration 9
• clone 5
• Backup Migration (WordPress plugin) 1
• WordPress Plugin Backup Migration 1

Latest Backupbliss CVEs

Newest publication first

1. CVE-2023-54346 WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download

   Published 2026-05-05

   High·CVSS 8.7 EPSS 0.31%

   WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and com...

2. CVE-2024-43297 WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability

   Published 2024-11-01

   High·CVSS 8.8 EPSS 0.45%

   Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.

3. CVE-2024-43298 WordPress Clone plugin <= 2.4.5 - Broken Access Control vulnerability

   Published 2024-11-01

   High·CVSS 8.8 EPSS 0.45%

   Missing Authorization vulnerability in Migrate Clone allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clone: from n/a through 2.4.5.

4. CVE-2023-6266 Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure

   Published 2024-01-11

   High·CVSS 7.5 EPSS 2.1%

   The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated at...

5. CVE-2023-6750 Clone < 2.4.3 - Unauthenticated Backup Download

   Published 2024-01-08

   High·CVSS 7.5 EPSS 2.0%

   The Clone WordPress plugin before 2.4.3 uses buffer files to store in-progress backup informations, which is stored at a publicly accessible, statically defined file path.

6. CVE-2023-6271 Backup Migration Staging < 1.3.6 - Sensitive Data Exposure

   Published 2024-01-01

   High·CVSS 7.5 EPSS 0.69%

   The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.

7. CVE-2023-7002 Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url

   Published 2023-12-23

   High·CVSS 7.2 EPSS 30.8%

   The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on...

8. CVE-2023-6971 Backup Migration 1.0.8 - 1.3.9 - Remote File Inclusion via content-dir

   Published 2023-12-23

   Critical·CVSS 9.8 EPSS 6.4%

   The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful...

9. CVE-2023-6972 Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion

   Published 2023-12-23

   Critical·CVSS 9.8 EPSS 1.4%

   The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticate...

10. CVE-2023-6553 Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

    Published 2023-12-15

    Critical·CVSS 9.8 EPSS 97.8% Framework module Public exploit

    The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that t...

11. CVE-2023-0958 Inisev Plugins (Various Versions) - Missing Authorization on handle_installation function

    Published 2023-07-28

    Medium·CVSS 6.5 EPSS 0.69%

    Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticate...

12. CVE-2023-3977 Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function

    Published 2023-07-28

    Medium·CVSS 4.3 EPSS 0.61%

    Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it...

13. CVE-2021-36884 WordPress Backup Migration plugin <= 1.1.5 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

    Published 2021-11-19

    Medium·CVSS 5.4 EPSS 0.57%

    Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.