Backup Migration
Backup Migration has 19 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 19 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 7 high. 2023 was the busiest year with 10 disclosures.
The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 4 of the records (21%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 19 issues recorded for Backup Migration has a vendor fix available, so running the current release closes all known holes.
16 independent researchers contributed these findings, most of them (2) reported by Chloe Chamberland. Backup Migration is installed on roughly 80,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2023-6972Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
Read the full analysisVulnerability Records

Backup Migration
Author
Inisev
TL;DR: 🚀 Lightning fast backups 🪶 Lightweight – just over 1MB ⚡ Super-quick migration with only a few clicks 🎯 Incredibly easy to use – no tech skills required ☁️ Many free storage options: Google Drive, Dropbox, OneDrive, pCloud, Amazon S3 & more 🔒 Exclusive own storage solution with 1GB of free space – unique on the market! 👉 Try it out instantly on a live demo — Creating a backup of your site has never been easier! Simply install the plugin, click on “Create backup now” – done. Website migration is just as easy and FREE, with just two clicks! Wide range of available cloud storage locations: Google Drive, Dropbox, OneDrive, Amazon S3, Wasabi, pCloud, SFTP & FTP, and free cloud storage BackupBliss. You can also schedule backups, e.g. define that a backup should be taken automatically every week (or every day/month). Use a wide choice of configuration options: Define exactly which files / databases should be in the backup, and which should not Define where the backup will be stored (store locally and/or backup to cloud) Define what name your backup should have, in which instances you should receive a notification email, and much more Additional advanced features included in the premium: smart exclusion rules, Tar and GZip compression methods, full email notifications, automatic backups before updates, and more. This plugin is all in one solution if you need to migrate your site to another host or just restore the local backup. Note: This (free) version is limited to backups of 4GB in size, due to native WordPress ZIP limitations. For unlimited sizes and increased stability for larger sites, please have a look at the Premium Plugin. The code of this free plugin is licensed under GPLv3, however, we claim rights to other content. Please read the full Terms of Use that touch other points as well and apply in entirety. If any questions come up, please ask us in the Support Forum – we’re always happy to help!
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C