Description

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-30T13:17:34.877Z",
  "pubdate": "2026-09-30T13:17:34.877Z",
  "executiveSummary": "The WordPress Backup & Migration plugin, in versions 1.6.0 and below, contains a critical broken access control vulnerability. This flaw allows unauthenticated remote attackers to bypass authorization checks within the plugin's administrative functionality. By exploiting this vulnerability, an attacker can perform sensitive operations, such as creating unauthorized backups, downloading existing backup files, or potentially modifying plugin configurations without requiring administrative privileges. The vulnerability stems from improper validation of access control tokens or authentication checks on critical API endpoints or AJAX handlers. This poses a significant security risk to the integrity and confidentiality of the WordPress installation, as it grants unauthorized access to administrative features that should be restricted to authenticated users with high-level privileges. Exploitation does not require prior knowledge of a user account or active session, making it a severe threat to systems utilizing the affected plugin version.",
  "technicalDetails": "The vulnerability resides in the authentication and authorization verification logic within the WordPress Backup & Migration plugin, specifically affecting versions 1.6.0 and earlier. The root cause is the failure to properly enforce capability checks (e.g., current_user_can('manage_options')) on plugin-specific endpoints, particularly those registered via the WordPress AJAX or REST API frameworks. In the affected versions, the plugin fails to verify if a request originates from an authorized user session before executing sensitive internal functions.\nThe attack flow commences when an unauthenticated attacker transmits a crafted HTTP request directly to the vulnerable endpoint or registered action hook. Because the plugin does not implement server-side verification of the requester's identity or authorization status, the application interprets the request as legitimate. An attacker can leverage this by invoking internal functions responsible for plugin operations, such as triggering the backup generation routine or accessing the filesystem to retrieve backup archives that may contain sensitive database contents, configuration files, or sensitive credentials.\nExploitation involves identifying the specific action names or API endpoints exposed by the plugin. Attackers may use automated tools to probe for these endpoints. Once identified, the attacker crafts a malicious request—typically utilizing the 'admin-ajax.php' interface or an unprotected REST API route—to invoke the plugin's administrative logic. Because the underlying code assumes that the request has already been validated by the core WordPress authentication system, the plugin proceeds to process the request with the implicit trust granted to administrative tasks.\nThe post-exploitation impact is severe. An attacker can exfiltrate sensitive site data, including full database backups containing user account hashes, plugin configurations, and potentially sensitive site metadata. Furthermore, in some deployment configurations, the ability to trigger unauthorized backups and subsequent downloads can lead to data exposure through the web-accessible file storage. By gaining the ability to manipulate backup operations, an attacker could also attempt to overwrite existing files if the plugin logic provides such functionality, leading to potential remote code execution or site defacement depending on the specific implementation of the plugin's file handling mechanisms. The vulnerability is exploitable remotely over the network, requiring only the ability to reach the public-facing URL of the WordPress installation."
}