CVE-2023-6266 is a High severity (CVSS 7.5) flaw in the Backup Migration plugin for WordPress, versions up to and including 1.3.6. Unauthenticated visitors could download backup files that hold passwords and database credentials. The record references version 1.3.7 code, so update to 1.3.7 or later.
What's affected
The NVD description is short and clear.
- Affected: Backup Migration (the plugin slug is backup-backup) in all versions up to and including 1.3.6.
- Fixed: the record does not state it. Its references include the plugin source at tag 1.3.7 alongside tags 1.3.5, which points to 1.3.7 as the first changed release. I could not load the plugin repository, so confirm on the plugin page.
- Severity: 7.5 High. The vulnerable code is the BMI_BACKUP case of the
handle_downloadingfunction, and the cause is insufficient path and file validation.
A neighbouring CVE. CVE-2023-6271 affects the same plugin and describes a different flaw, in which in-progress backup information sits in publicly readable files. Its sources say fixed in 1.3.6. The two entries have different versions and different bugs, so patching to 1.3.7 or later covers both. See the separate post on CVE-2023-6271.
How to check if you're exposed
Check each WordPress site that might use the plugin.
wp plugin list --fields=name,status,version | grep backup-backup
wp plugin update backup-backup
Then deal with the data. Backups are full copies of the site and its database. If an attacker could download one, the credentials inside it may be known to them. Check your web logs for requests to the plugin's download handler from addresses that are not yours, and see whether backup files are stored in a location that the web server serves directly.
For a fleet of sites, an inventory that lists plugin versions per site is the quickest way to find stragglers.
What to do now
- Update Backup Migration to 1.3.7 or later on every site, then confirm the version in the plugin list.
- Review access logs for downloads of backup archives by unknown visitors, covering the period the vulnerable version was live.
- If you cannot rule out a download, rotate database credentials, WordPress salts, API keys and administrator passwords.
- Delete old backup archives you no longer need, and store backups outside the web root or in remote storage.
- Restrict direct web access to the backup directory with a server rule as an extra layer.
Why it matters
The weaknesses are CWE-200, exposure of sensitive information, and CWE-552, files or directories accessible to external parties. The download handler did not validate the path and file well enough, so a request that should have been refused returned a backup.
A backup plugin is a high value target, because its output is exactly what an attacker wants: the database, the configuration file and the uploads. The vulnerability needs no login. The record's kev flag is false, and I found no source that reports exploitation. The practical lesson is to treat backup files as secrets and to keep them away from any path the web server can reach.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does updating undo a download that already happened?
No. If a backup could have been downloaded, rotate the credentials it contained after you update.
Is this the same as CVE-2023-6271?
No. Both affect Backup Migration, but CVE-2023-6271 is about in-progress backup information left in public files. Updating to 1.3.7 or later covers both.
Sources
- Backup Migration source at tag 1.3.7 (listed in the record, not readable when fetched)
- Wordfence entry (listed in the record, not readable when fetched)
Last reviewed: 19 October 2026.
