CVE-2023-6271: High Severity Data Exposure in Backup Migration

CVE-2023-6271 is a High severity (CVSS 7.5 in the NVD record) flaw in the Backup Migration WordPress plugin before version 1.3.6. It stores in-progress backup information in publicly accessible files, which can leak sensitive site data. Update to 1.3.6 or later, and to the newest release if you can.

What's affected

The NVD description, WPScan and the discoverer's write up agree on the range.

• Affected: Backup Migration (plugin slug backup-backup) before 1.3.6.
• Fixed: 1.3.6. WPScan lists "Fixed in 1.3.6", and the researcher's timeline says the author released the update in December 2023.
• Severity: the NVD record gives 7.5 High. The researcher's page, from CleanTalk, lists CVSS 8.2 High, so the sources differ by about three quarters of a point and agree on High.
• Weakness class: the NVD record carries no CWE. The researcher classifies it as sensitive data disclosure, CWE-200.

A neighbouring CVE. CVE-2023-6266 affects the same plugin and covers a separate bug in the backup download handler, in versions up to 1.3.6. Moving to 1.3.7 or later addresses both.

How to check if you're exposed

Check versions on every site.

wp plugin list --fields=name,status,version | grep backup-backup
wp plugin update backup-backup

Then check for leftover files. The researcher's write up says in-progress backup data was written into files in a directory under the plugin that visitors could request, and that those files could contain data from many database tables. Look inside the plugin directory on disk for log style files created during backup runs and delete the ones that are stale. Check your access logs for requests to those paths from unknown addresses.

The write up describes the risk as full compromise of a site in the worst case, which is the researcher's assessment. Treat it as a reason to rotate credentials, not as proof of any attack on your site.

What to do now

1. Update Backup Migration to 1.3.6 or later, and preferably to the latest release.
2. Delete stale files that the plugin created during backup runs, after taking a copy if you need evidence.
3. Review access logs for requests to the plugin's directories from addresses you do not recognize.
4. Rotate WordPress salts, database credentials and administrator passwords if you find any such requests.
5. Keep backups out of web accessible folders, and block direct web requests to plugin working directories at the web server.

Why it matters

This entry has no CWE in the NVD record, so the weakness is described in the text. The researcher classifies it as CWE-200, exposure of sensitive information to an unauthorized actor. The plugin wrote working data to a place visitors could request, and the data included information from the site's database.

The lesson is about where temporary files go. Any file that an application writes as part of a job, whether a log, a queue or a partial export, is still data and needs the same protection as the finished product. The kev flag is false, and the sources do not report exploitation in the wild. They do include a proof of concept write up from the researcher, which I did not use for details here.

Quick check

Sources

• WPScan entry
• CleanTalk research write up

Last reviewed: 19 October 2026.