What’s Vulnerable › Vulnerabilities

CVE-2023-6971

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-23 · updated 2026-06-17
• Weakness: CWE-829

Description

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

Affected products

• inisev BackupBliss – Backup & Migration with Free Cloud Storage: from 1.0.8 before 1.4.0 — fixed in 1.4.0

How to fix

Upgrade to a fixed version: inisev BackupBliss – Backup & Migration with Free Cloud Storage 1.4.0. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php
• https://plugins.trac.wordpress.org/changeset/3012745/backup-backup
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.php
• https://plugins.trac.wordpress.org/changeset/3012745/backup-backup
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427?source=cve

Get alerted when CVE-2023-6971 or the next vulnerability affects your stack