CVE-2026-18216: Backup Migration < 2.1.7 - Admin+ Privilege Escalation via Post-Restore Auto-Login
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backup Migration (WordPress plugin)to a version that resolves this vulnerability.Fixed in 2.1.7
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18216?
The severity of CVE-2026-18216 is rated at 65, indicating a medium risk level.
How can I fix CVE-2026-18216?
To fix CVE-2026-18216, update the Backup Migration WordPress plugin to version 2.1.7 or later.
What is the impact of CVE-2026-18216 on WordPress sites?
CVE-2026-18216 allows unauthorized admin privilege escalation across sites in a multisite network, posing a significant security risk.
Which versions of the Backup Migration plugin are affected by CVE-2026-18216?
All versions of the Backup Migration plugin before 2.1.7 are affected by CVE-2026-18216.
Is CVE-2026-18216 related to multisite WordPress networks?
Yes, CVE-2026-18216 specifically affects multisite WordPress networks, allowing cross-site admin access vulnerabilities.