CVE-2025-12394: Backup Migration < 2.0.0 - Unauthenticated Backup Download
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backup Migration WordPress pluginto a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12394?
CVE-2025-12394 is classified as a critical vulnerability due to its ability to allow unauthenticated users to access sensitive backup files.
How do I fix CVE-2025-12394?
To mitigate CVE-2025-12394, upgrade the WordPress Backup Migration plugin to version 2.0.0 or later.
What are the risks of CVE-2025-12394?
The risks of CVE-2025-12394 include unauthorized access to backup files, which may contain sensitive information.
Who is affected by CVE-2025-12394?
Any WordPress site using the Backup Migration plugin version before 2.0.0 is affected by CVE-2025-12394.
What does CVE-2025-12394 disclose?
CVE-2025-12394 discloses the filename of backup archives, potentially exposing critical backup data to unauthorized users.