What’s Vulnerable › Vulnerabilities
CVE-2023-7002: Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 30.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2023-12-23 · updated 2026-06-17
- Weakness: CWE-78
Description
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
Affected products
- inisev BackupBliss – Backup & Migration with Free Cloud Storage: before 1.4.0 — fixed in 1.4.0
How to fix
Upgrade to a fixed version: inisev BackupBliss – Backup & Migration with Free Cloud Storage 1.4.0. Check the vendor advisory for mitigations.
References
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1503
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1518
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L88
- https://plugins.trac.wordpress.org/changeset/3012745/backup-backup
- https://www.linuxquestions.org/questions/linux-security-4/php-function-exec-enabled-how-big-issue-4175508082/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568?source=cve
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1503
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L1518
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php#L88
- https://plugins.trac.wordpress.org/changeset/3012745/backup-backup
- https://www.linuxquestions.org/questions/linux-security-4/php-function-exec-enabled-how-big-issue-4175508082/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568?source=cve
Get alerted when CVE-2023-7002 or the next vulnerability affects your stack