CVE-2026-127050
Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback
CVSS Score
6.4
EPSS Score
0.0%
EPSS Percentile
0th
Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing ".." sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution.
| CWE | CWE-22 |
| Vendor | inisev |
| Product | backup migration |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for inisev backup migration
Be the first to know when new medium vulnerabilities affecting inisev backup migration are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
inisev / Backup Migration
0 < 2.1.8
References
Credits
Yll Berisha