Veille CVE

Recherche « Unknown Backup Migration »

12 CVE

Critique 1 Élevée 3 Moyenne 8 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Backup Migration » ✕
  1. CVE-2026-82841 5.3 Moyenne

    Unknown UpdraftPlus: WP Backup & Migration Plugin

    The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.

  2. CVE-2026-81810 7.2 Élevée

    Unknown All-in-One WP Migration and Backup

    The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration.

  3. CVE-2026-82194 5.5 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root.

  4. CVE-2026-82193 5.5 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files.

  5. CVE-2026-82182 4.1 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using it in a SQL query, allowing administrators to perform SQL injection attacks.

  6. CVE-2026-19453 7.1 Élevée

    Unknown JetBackup

    The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

  7. CVE-2026-19722 6.6 Moyenne

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution.

  8. CVE-2026-76549 5.9 Moyenne

    Unknown UpdraftPlus: WP Backup & Migration Plugin

    The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

  9. CVE-2026-19725 9.1 Critique

    Unknown WPvivid — Backup, Migration & Staging

    The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of the site, including the web root. The file name always carries a fixed suffix and the contents are always the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131's own log header, so only the location of the file is attacker controlled.

  10. CVE-2026-17533 7.2 Élevée

    Unknown All-in-One WP Migration and Backup

    The All-in-One WP Migration and Backup WordPress plugin before 7.108 does not restrict its migration import functionality to network administrators on multisite installations, allowing an administrator of a single subsite to execute arbitrary PHP code across the entire network.

  11. CVE-2026-18216 6.5 Moyenne

    Unknown Backup Migration

    The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.

  12. CVE-2026-12898 6.5 Moyenne

    Unknown All-in-One WP Migration and Backup

    The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.