CVE-2023-6553 in the critical feed json
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
published 2023-12-15 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58782
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 97.8%
- EPSS 97.8% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 2
- Metasploit, Exploit-DB, plus a Nuclei check
Summary
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
Patch / fix
Timeline
- First public exploit (Metasploit exploit/multi/http/wp_backup_migration_php_filter)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
97.85% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/multi/http/wp_backup_migration_php_filter WordPress Backup Migration Plugin PHP Filter Chain RCE metasploit exploit, excellent rank, 2023-12-11
- EDB-52486 WordPress Backup Migration 1.3.7 - Remote Command Execution webapps, 2026-03-03
- Nuclei template Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- inisev BackupBliss – Backup & Migration with Free Cloud Storage
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
- Technology feeds
References
-
plugins.trac.wordpress.org
/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38
patch
-
plugins.trac.wordpress.org
/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62
patch
-
plugins.trac.wordpress.org
/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64
patch
-
plugins.trac.wordpress.org
/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118
patch
-
plugins.trac.wordpress.org
/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cve
third-party-advisory
-
synacktiv.com
/en/publications/php-filters-chain-what-is-it-and-how-to-use-it
not-applicable
- packetstormsecurity.com /files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html
Sources
- CVE List CVE-2023-6553
- NVD CVE-2023-6553
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.