Skip to content
Sign in
6.5 Medium

CVE-2026-18216 The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login…

Description

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.

Affected products and versions

Product Affected versions Fixed in
Backup Migration 2.1 earliest → < 2.1.7 2.1.7

Other CVEs of Backup Migration

The 3 CVEs of Backup Migration →
CVE-2025-12394 The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server… 5.9 Medium CVE-2023-6271 The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find,… 7.5 High
Track this CVE