CVE-2026-7693 in Backup Migration Plugin
Summary
by MITRE • 08/05/2026
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the `file` POST parameter on the `restoreBackup()` AJAX handler. The handler applies `esc_attr()` — an HTML-context sanitizer that does not strip shell metacharacters — and concatenates the result, unquoted, into a `php-cli -f … bmi_restore <file> <remote>` command passed to `exec()`. This makes it possible for authenticated attackers, with Administrator-level access (or any user granted the plugin's `do_backups` capability) and above, to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as `DISALLOW_FILE_EDIT` and `DISALLOW_FILE_MODS` that would otherwise prevent code execution from the admin UI. This is an incomplete fix of CVE-2023-7002, which patched the same pattern only in the `$_POST['url']` path of `handleQuickMigration()`; the equivalent mitigations (`rawurlencode()` + explicit shell-metachar replacement + double-quoting in `exec()`) were never applied to `$backupName`.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Backup Migration plugin for WordPress presents a critical operating system command injection vulnerability affecting versions up to and including 2.1.5.1. This flaw exists within the restoreBackup() AJAX handler where insufficient input sanitization permits attackers to inject malicious commands through the file POST parameter. The vulnerability stems from the improper use of esc_attr() function which serves as an HTML context sanitizer but fails to address shell metacharacters that could enable command execution. When the plugin processes backup restoration requests, it concatenates the unsanitized user input directly into a php-cli command without proper quoting mechanisms.
The technical implementation of this vulnerability allows authenticated attackers with administrator privileges or users possessing the do_backups capability to execute arbitrary operating system commands under the web server user context. This represents a significant bypass of WordPress security measures including DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants that typically prevent code execution through the administrative interface. The attack vector specifically targets the restoreBackup() method where the file parameter undergoes inadequate sanitization before being incorporated into an exec() function call structure. The vulnerability demonstrates a pattern previously addressed in CVE-2023-7002 but incompletely remediated, as similar protections were only applied to the url parameter path within handleQuickMigration().
The operational impact of this vulnerability extends beyond typical privilege escalation scenarios since it enables attackers to perform complete system compromise through the web server's execution context. Attackers can leverage this weakness to execute malicious commands that may include file manipulation, data exfiltration, network reconnaissance, or even establish persistent access mechanisms. The vulnerability affects any WordPress installation running the affected plugin version and requires only authentication with sufficient privileges rather than complex attack chains. Security researchers categorize this issue under CWE-78 as improper neutralization of special elements used in OS commands.
Mitigation strategies for this vulnerability should focus on immediate remediation through plugin updates to versions that properly address the command injection flaw. Organizations must ensure that all administrative users maintain strong authentication credentials and implement least privilege access controls to limit potential exploitation scope. The fix methodology requires implementing proper shell argument sanitization including rawurlencode() function usage, explicit replacement of shell metacharacters, and mandatory double-quoting of arguments in exec() calls. Additionally, network segmentation and web application firewalls should be configured to monitor for suspicious command execution patterns. Organizations should conduct comprehensive security audits of their WordPress installations to identify other potentially vulnerable plugins and ensure proper input validation across all user-controllable parameters. The ATT&CK framework categorizes this vulnerability under T1059.001 for Command and Scripting Interpreter with potential progression toward privilege escalation and persistence techniques through the compromised web server account.