WordPress security changelog
HIGH CVE-2026-7693 Deferred

Backup Migration restore filename permits administrator OS command injection

Backup Migration through 2.1.5.1 passes the file POST parameter to the restoreBackup() AJAX handler. The handler applies esc_attr(), which is an HTML-context encoder and leaves shell metacharacters usable, then concatenates the value without quoting into a php-cli bmi_restore command passed to exec(). An Administrator, or any user granted do_backups, can execute arbitrary operating-system commands as the web-server user. The CNA's structured affected table incorrectly stops at 2.1.1, while its narrative and the linked 2.1.5.1-to-2.1.5.2 patch establish the later boundary.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Backup Migration
Plugin slug
backup-backup
Affected
<= 2.1.1
Safe version
2.1.5.2
Published
Aug 05, 2026
Weakness
CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection')

This CVE was published Aug 05, 2026 and is one of 12 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Backup Migration to 2.1.5.2 or later. Review backup-restore requests, web-server processes and filesystem changes, and rebuild from a trusted source if command execution may have occurred.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_restore <file> <remote>` command passed to `exec()`. This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's `do_backups` capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the `$_POST['url']` path of `handleQuickMigration()`; the equivalent mitigations (`rawurlencode()` + explicit shell-metachar replacement + double-quoting in `exec()`) were never applied to `$backupName`.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources