CVE-2026-97197 in Backup & Migration Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified as an unauthenticated broken access control flaw within the WordPress Backup and Migration plugin, specifically affecting versions up to 1.6.0, represents a critical security deficiency that allows unauthorized actors to interact with sensitive administrative functions without valid credentials. This type of vulnerability typically stems from insufficient server-side validation of user permissions when handling requests related to backup creation, restoration, or configuration management. In the context of WordPress ecosystems, where plugins often extend core functionality by hooking into various actions and filters, a failure to properly enforce access controls on these hooks can expose powerful capabilities to any internet-facing visitor. The attacker does not need to possess an account with administrator privileges nor even a standard user account; they simply need to craft specific HTTP requests targeting the vulnerable endpoints exposed by the plugin's API or AJAX handlers.
From a technical perspective, this flaw likely involves the manipulation of parameters that trigger backup generation processes or allow for the download of previously created archive files without verifying if the requesting session holds the necessary capabilities defined in WordPress role and capability architecture. By exploiting this misconfiguration, an attacker can potentially extract database dumps containing user credentials, site configurations, and other sensitive data stored within the WordPress installation. Furthermore, depending on how the backup mechanism is implemented, there may be risks associated with arbitrary file inclusion or remote code execution if the plugin fails to sanitize inputs used in system commands for archiving files. The absence of authentication checks means that these operations are effectively public, turning a legitimate administrative tool into an attack vector for data exfiltration and site compromise.
The operational impact of this vulnerability is severe, primarily due to its potential for widespread exploitation given the popularity of both WordPress and backup plugins in the web hosting landscape. Successful exploitation can lead to full database disclosure, which often includes hashed passwords that are susceptible to offline brute-force attacks or rainbow table lookups if weak hashing algorithms like MD5 were used during user registration. Additionally, access to backup files may reveal sensitive information such as API keys for third-party services, email credentials, and internal network configurations embedded in configuration files. This level of data exposure can facilitate further lateral movement within a hosting environment or lead to identity theft and financial fraud if personal customer data is stored on the compromised site. The ease of exploitation without authentication significantly lowers the barrier to entry for attackers, including automated bots scanning for vulnerable instances across the internet.
To mitigate this risk, immediate action must be taken by updating the WordPress Backup & Migration plugin to a version greater than 1.6.0 where these access control issues have been addressed by the developers. Site administrators should verify that all plugins are kept up-to-date with the latest security patches provided by their vendors. In addition to patching, implementing Web Application Firewalls can provide an additional layer of defense by blocking malicious request patterns associated with backup endpoint abuse. It is also advisable to restrict access to WordPress admin areas and plugin-specific endpoints using IP whitelisting or two-factor authentication where possible, although these measures are secondary to fixing the underlying code vulnerability. Regular security audits and penetration testing should be conducted to identify similar broken access control issues in other plugins that may share architectural similarities with this vulnerable component.
This incident aligns with Common Weakness Enumeration category CWE-284, which describes Improper Access Control, highlighting the failure of a system to restrict access to resources based on user identity or role. It also maps to MITRE ATT&CK techniques related to Initial Access and Credential Access, as attackers can leverage this flaw to gain unauthorized entry and subsequently harvest credentials for deeper infiltration. Understanding these mappings helps security teams prioritize remediation efforts by recognizing the broader implications of such flaws in modern web application architectures. The incident underscores the importance of rigorous input validation and strict enforcement of authorization checks on all server-side operations, particularly those involving sensitive data processing or system-level commands within content management systems.