Skip to content
Sign in
5.9 Medium

CVE-2025-12394 The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server…

Description

The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.

Affected products and versions

Product Affected versions Fixed in
Backup Migration 2.0 earliest → < 2.0.0 2.0.0

Other CVEs of Backup Migration

The 3 CVEs of Backup Migration →
CVE-2026-18216 The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login… 6.5 Medium CVE-2023-6271 The Backup Migration WordPress plugin before 1.3.6 stores in-progress backups information in easy to find,… 7.5 High
Track this CVE