CVE-2023-6972
Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
Vexday Risk Score
48Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 9.8EPSS 1.4%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
23 Dec 2023Published on NVD
13 Apr 2026Public PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
inisev · BackupBliss – Backup & Migration with Free Cloud Storagepublic PoCs found — 1
githubgithub.com/0x00phantom-hat/CVE-2023-6972-Exploit-Arbitrary-File-Deletion★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.phphttps://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/bypasser.phphttps://plugins.trac.wordpress.org/changeset/3012745/backup-backuphttps://www.wordfence.com/threat-intel/vulnerabilities/id/0a3ae696-f67d-4ed2-b307-d2f36b6f188c?source=cve