CVE-2023-7002

HOCH 7.2CVE-2023-7002 · Published 23/12/2023 · updated 17/06/2026

Package	Affected versions	Patched versions
backup migration backupbliss	`< 1.4.0`	`1.4.0`

Description

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.

References

plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php · Exploit
plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php · Exploit
plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/ajax.php · Exploit
plugins.trac.wordpress.org/changeset/3012745/backup-backup · Patch
linuxquestions.org/questions/linux-security-4/php-function-exec-enabled-how-big-issue-4175508082 · Patch
wordfence.com/threat-intel/vulnerabilities/id/cc49db10-988d-42bd-a9cf-9a86f4c79568 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free