Backup Migration vulnerabilities

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to 2.1.5.1 due to insufficient sanitization of the 'file' POST parameter on the restoreBackup() AJAX handler. Authenticated attackers with Administrator-level access can execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants.

Backup Migration versions up to 2.1.1 have a vulnerability that allows unauthorized access to sensitive data.

The Backup Migration plugin for WordPress up to version 2.0.0 has a missing authorization in the initializeOfflineAjax function and lacks nonce verification. The endpoint only validates hardcoded tokens publicly exposed in the plugin's JavaScript, allowing unauthenticated attackers to trigger backup upload queue processing, potentially causing unexpected transfers to configured cloud storage targets and resource exhaustion.