🔐 CVE Alert

CVE-2023-6553

CRITICAL 9.8

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

CWE CWE-94
Vendor inisev
Product backupbliss – backup & migration with free cloud storage
Published Dec 15, 2023
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for inisev backupbliss – backup & migration with free cloud storage

Be the first to know when new critical vulnerabilities affecting inisev backupbliss – backup & migration with free cloud storage are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

inisev / BackupBliss – Backup & Migration with Free Cloud Storage
0 ≤ 1.3.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118 synacktiv.com: https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail= packetstormsecurity.com: http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html

Credits

Nex Team