Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

WordPress Backup & Migration plugin allows unauthorized data export

CVE-2026-97197 · published 1 month ago
Summary

The Backup & Migration plugin for WordPress (versions up to 1.6.0) does not properly check who is requesting a backup. This means anyone on the internet could download site files or databases without permission. Update the plugin to the latest version or remove it if you cannot apply the update.

What to do
  • Update webtoffee wordpress backup & migration to version 1.6.1.
Affected software
VendorProductAffected versions
webtoffee wordpress backup & migration <= 1.6.0
Fix: upgrade to 1.6.1
Original advisory text
WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published30 Sep 2026
Updated3 Nov 2026
First seen30 Sep 2026
Sources
CVE-2026-97197 · NVD
CVE-2026-97197 · MITRE
Track software like this
Free during beta