OS Command Injection Vulnerability in Backup Migration Plugin for WordPress

CVE-2026-7693

What is CVE-2026-7693?

The Backup Migration plugin for WordPress is exposed to an OS Command Injection vulnerability due to inadequate sanitization of the file POST parameter in the restoreBackup() AJAX handler. The use of esc_attr() does not prevent shell metacharacters, allowing authenticated attackers with Administrator access or elevated privileges to execute malicious OS commands on the server. This vulnerability effectively bypasses WordPress security constraints like DISALLOW_FILE_EDIT, posing a significant risk to the web server. This issue is a continuation of an earlier vulnerability, highlighting the need for comprehensive input validation and sanitization measures.

References