SQL Injection Vulnerability in WebToffee WP Backup and Migration Plugin for WordPress

CVE-2026-120530

What is CVE-2026-120530?

The WebToffee WP Backup and Migration plugin for WordPress is susceptible to SQL injection through the 'description' parameter in versions up to 1.6.1. Insufficient escaping of user input and inadequate SQL query preparation allow authenticated users with subscriber-level access and higher to inject additional SQL commands. This exploitation could lead to unauthorized access to sensitive database information. To successfully exploit this vulnerability, an administrator must execute the plugin's database export or restore operations, emphasizing the need for caution during these tasks.

References