Vulnerability Description
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Backupbliss | Backup Migration | <= 1.3.7 |
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatch
- https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-tNot Applicable
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8abThird Party Advisory
- http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Rem
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/bacPatch
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&oldPatch
- https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-tNot Applicable
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8abThird Party Advisory
FAQ
What is CVE-2023-6553?
CVE-2023-6553 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being a...
How severe is CVE-2023-6553?
CVE-2023-6553 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-6553?
Check the references section above for vendor advisories and patch information. Affected products include: Backupbliss Backup Migration.