CVE-2023-54346 - WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download

Back Back to CVE browser

HIGH

WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download

Published May 5, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.31%

Description

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.

Affected products

Vendor Backupbliss Product WordPress Plugin Backup Migration Default
n/a
- Version
  1.2.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Backupbliss

WordPress Plugin Backup Migration

n/a

Version	Status	Constraints
1.2.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-538

References (5)

https://backupbliss.com/
product
https://downloads.wordpress.org/plugin/backup-backup.1.2.8.zip
product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60568
Advisory
https://www.exploit-db.com/exploits/51445
exploit
https://www.vulncheck.com/advisories/wordpress-plugin-backup-migration-unauthenticated-database-backup-download
third-party-advisory

Link	Providers	Tags
https://backupbliss.com/		product
https://downloads.wordpress.org/plugin/backup-backup.1.2.8.zip		product
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-60568		Advisory
https://www.exploit-db.com/exploits/51445		exploit
https://www.vulncheck.com/advisories/wordpress-plugin-backup-migration-unauthenticated-database-backup-download		third-party-advisory