CVE-2025-14944
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
The Backup Migration plugin for WordPress up to version 2.0.0 has a missing authorization in the initializeOfflineAjax function and lacks nonce verification. The endpoint only validates hardcoded tokens publicly exposed in the plugin's JavaScript, allowing unauthenticated attackers to trigger backup upload queue processing, potentially causing unexpected transfers to configured cloud storage targets and resource exhaustion.
Risk Assessment
An attacker could trigger unauthorized backup transfers to external cloud services, potentially leading to data leakage or server overload.
Recommendation
Update the Backup Migration plugin to the latest version that includes a fix. If not possible, temporarily disable the plugin or restrict access to it.
Other vulnerabilities in Backup Migration
See all- CVE-2026-7693High
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to 2.1.5.1 due to insufficient sanitization of the 'file' POST parameter on the restoreBackup() AJAX handler. Authenticated attackers with Administrator-level access can execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants.
- CVE-2026-39480High
Backup Migration versions up to 2.1.1 have a vulnerability that allows unauthorized access to sensitive data.
Original NVD description (English source)
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS