Unauthorized Data Access in Backup Migration Plugin for WordPress by WordPress

CVE-2023-6266

Summary

The Backup Migration plugin for WordPress contains a vulnerability that allows unauthorized access to sensitive backup files due to inadequate path and file validation. Specifically, the weakness exists in the BMI_BACKUP case of the handle_downloading function across all versions up to 1.3.6. This flaw can lead to unauthenticated attackers downloading confidential data, including user passwords, personally identifiable information (PII), database credentials, and other sensitive content stored within backups.

References