Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?JetBackupWPvividbackup-backupEverest BackupXClonerWP Database BackupAll-in-One WP Migration and BackupBackup and Staging by
Plugin · backup-backup
backup-backup
17 known vulnerabilities on record. Add your version above to see which ones affect you.
Aug 15, 2026Backup Migration: Does not properly restrict a post-restore automatic login mechanismCVE-2026-18216 · fixed in 2.1.7 · reported by WPScanMedium 6.5
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Aug 5, 2026Backup Migration: OS Command InjectionCVE-2026-7693 · affects up to 2.1.5.1 · reported by WordfenceHigh 7.2
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_restore <file> <remote>` command passed to `exec()`. This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's `do_backups` capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the `$_POST['url']` path of `handleQuickMigration()`; the equivalent mitigations (`rawurlencode()` + explicit shell-metachar replacement + double-quoting in `exec()`) were never applied to `$backupName`.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 15, 2026Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.CVE-2026-39480 · affects up to 2.1.1 · reported by PatchstackHigh 7.5
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
May 5, 2026WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database bacCVE-2023-54346 · reported by VulnCheckHigh 8.7
WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.
Apr 7, 2026Backup Migration: Missing AuthorizationCVE-2025-14944 · affects up to 2.0.0 · reported by WordfenceMedium 5.3
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 24, 2025Backup Migration: Does not properly generate its backup path in certain server configurationsCVE-2025-12394 · fixed in 2.0.0 · reported by WPScanMedium 5.9
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
Jan 4, 2025Backup Migration: PHP Object InjectionCVE-2024-10932 · affects up to 1.4.6 · reported by WordfenceHigh 8.8
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 18, 2024Backup Migration: Insertion of Sensitive Information into Log FileCVE-2024-32686 · affects up to 1.4.3 · reported by PatchstackMedium 5.3
Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.
Jan 11, 2024Backup Migration: Unauthorized access of dataCVE-2023-6266 · affects up to 1.3.6 · reported by WordfenceHigh 7.5
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 1, 2024Backup Migration: Stores in-progress backups information in easy to findCVE-2023-6271 · fixed in 1.3.6 · reported by WPScanHigh 7.5
The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find, publicly-accessible files, which may allow attackers monitoring those to leak sensitive information from the site's backups.
Dec 22, 2023Backup Migration: OS Command InjectionCVE-2023-7002 · affects up to 1.3.9 · reported by WordfenceHigh 7.2
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 22, 2023Backup Migration: Path TraversalCVE-2023-6972 · affects up to 1.3.9 · reported by WordfenceCritical 9.8
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 22, 2023Backup Migration: Remote File InclusionCVE-2023-6971 · affects 1.0.8 to 1.3.9 · reported by WordfenceHigh 8.1
The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 15, 2023Backup Migration: Remote Code ExecutionCVE-2023-6553 · affects up to 1.3.7 · reported by WordfenceCritical 9.8
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2023Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on theCVE-2023-3977 · reported by WordfenceMedium 4.3
Several plugins for WordPress by Inisev are vulnerable to Cross-Site Request Forgery to unauthorized installation of plugins due to a missing nonce check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for unauthenticated attackers to install plugins from the limited list via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 28, 2023Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation funcCVE-2023-0958 · reported by WordfenceMedium 4.3
Several plugins for WordPress by Inisev are vulnerable to unauthorized installation of plugins due to a missing capability check on the handle_installation function that is called via the inisev_installation AJAX aciton in various versions. This makes it possible for authenticated attackers with minimal permissions, such as subscribers, to install select plugins from Inisev on vulnerable sites. CVE-2023-38514 appears to be a duplicate of this vulnerability.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 19, 2021Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.CVE-2021-36884 · affects up to 1.1.5 · reported by PatchstackMedium 4.8
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.