CVE-2023-6505 is a high severity flaw in the Migrate WordPress Website and Backups plugin, also known as Prime Mover. Before version 1.9.3 it does not prevent directory listing in folders that hold export files. Update to 1.9.3 or later and check whether exports were exposed.
What's affected
- Product: Migrate WordPress Website and Backups (Prime Mover), a WordPress plugin.
- Affected: versions before 1.9.3, per the record.
- Fixed: 1.9.3.
- Exposure: directory listing of folders containing export files, with no login.
The record gives a CVSS 3.1 base score of 7.5 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
Then test whether export folders are browsable. From outside your network, request the plugin export directory in a browser. If you see a list of files, they are exposed. Look in the plugin documentation for the directory name.
What to do now
- Update the plugin to 1.9.3 or later.
- Delete old export files you no longer need.
- Turn off directory listing at the web server for the whole site.
- If exports held full site backups, treat the database contents and configuration secrets as possibly read and rotate them.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record lists no CWE for this entry, so the weakness class is taken from the description alone.
The record lists no CWE for this entry. The description is about directory listing. When a folder has no index file and the server allows listing, anyone can see and fetch what is inside.
Export files from a migration plugin are valuable. They usually hold the database and uploads, which can include user data and keys. The risk comes from the combination of a predictable location and a missing listing block, and the web server setting is the fix that protects every plugin, not just this one.
Quick check
Why is there no CWE listed?
The NVD record has none for this CVE. The weakness is described as a missing directory listing protection.
Is updating enough?
Update, delete old exports and rotate secrets if exports were reachable.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
