WordPress plugin
Backup Migration security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 19 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical3
- High7
- Medium9
- Low0
All Backup Migration vulnerabilities
- High7.2Authenticated (Administrator+) OS Command Injection via 'file' Parameter
≤2.1.1Update to 2.1.5.2
- High7.5Information Exposure to Unauthenticated Back-up Download
≤1.4.9Update to 2.0.0
- High8.8Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
≤1.4.6Update to 1.4.6.1
- High7.2Authenticated (Admin+) OS Command Injection via url
≤1.3.9Update to 1.4.0
- Critical9.8Unauthenticated Path Traversal to Arbitrary File Deletion
≤1.3.9Update to 1.4.0
- High8.11.3.9 - Remote File Inclusion via content-dir
1.0.8 – 1.3.9Update to 1.4.0
- Critical9.8Unauthenticated Remote Code Execution
≤1.3.7Update to 1.3.8
- Critical9.8Unauthenticated Sensitive Information Exposure
≤1.3.5Update to 1.3.6
- High7.5Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
≤1.3.6Update to 1.3.7
- High7.5Sensitive Information Exposure
≤1.2.8Update to 1.2.9
Backup Migration: common questions
Does Backup Migration have known vulnerabilities?
Yes. VulnCrest Radar lists 19 known vulnerabilities in Backup Migration: 3 critical, 7 high, 9 medium. None are known to affect version null.
How do I check which version of Backup Migration I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Backup Migration vulnerability?
CVE-2026-18216, published Aug 13, 2026: Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation. Severity: Medium (CVSS 4.7).
Is any Backup Migration vulnerability listed in CISA KEV?
No. None of the known Backup Migration vulnerabilities is currently listed in the CISA KEV catalog.