CVE-2023-6553: Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6553?
CVE-2023-6553 has a critical severity rating due to its potential for remote code execution.
How do I fix CVE-2023-6553?
To fix CVE-2023-6553, update the Backup Migration plugin to version 1.3.8 or later.
Which versions of Backup Migration are affected by CVE-2023-6553?
All versions of Backup Migration up to and including 1.3.7 are affected by CVE-2023-6553.
Can attackers exploit CVE-2023-6553 without authentication?
Yes, attackers can exploit CVE-2023-6553 remotely without authentication.
What type of vulnerabilities does CVE-2023-6553 represent?
CVE-2023-6553 represents a Remote Code Execution vulnerability due to improper input validation.