Path Traversal Vulnerability in Backup Migration Plugin for WordPress

CVE-2026-127050

What is CVE-2026-127050?

The Backup Migration plugin for WordPress, prior to version 2.1.8, is susceptible to a path traversal vulnerability. This flaw exists in the plugin's PclZip restore fallback mechanism, which allows an attacker to exploit improperly handled zip archive entries. By crafting a zip file with directory traversal sequences, an attacker can execute arbitrary file writes on servers that do not have the PHP zip extension enabled. If an administrator restores such a malicious backup, it can result in the execution of a PHP file outside the expected directory structure, potentially leading to unauthorized access and remote code execution.

References