CVE-2023-54346

HIGH 8.7 CVSS 4.0

Published: May 5, 2026
Last modified: October 28, 2026
NVD status: Deferred
Reported by: disclosure@vulncheck.com
Weakness: CWE-538
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.

Affected products and versions

Backupbliss WordPress Plugin Backup Migration — Version 1.2.8

References

backupbliss.com https://backupbliss.com/
downloads.wordpress.org https://downloads.wordpress.org/plugin/backup-backup.1.2.8.zip
www.exploit-db.com https://www.exploit-db.com/exploits/51445
www.vulncheck.com https://www.vulncheck.com/advisories/wordpress-plugin-backup-migration-unauthenticated-database-backup-download
nvd.nist.gov Official NVD record

WordPress CVEs

Description

Affected products and versions

References