PT-2023-7889 · WordPress · Backup Migration

Nex Team + 1 · Published 2023-12-05 · Updated 2026-03-06 · CVE-2023-6553

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Backup Migration plugin for WordPress versions up to, and including, 1.3.7

Description The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include statement, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server. The estimated number of potentially affected devices worldwide is around 50,000 to 90,000 websites.

Recommendations Update the Backup Migration plugin to version 1.3.8 or later to resolve the issue. As a temporary workaround, consider disabling the includes/backup-heart.php file until a patch is available. Restrict access to the vulnerable backup-heart.php file to minimize the risk of exploitation. Avoid using the Backup Migration plugin until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-94

Related Identifiers

BDU:2023-08960

CVE-2023-6553

Affected Products

Backup Migration

References · 62

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_backup_migration_php_filter.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-6553 · Exploit
• 🔥 https://exploit-db.com/exploits/52486 · Exploit
• 🔥❌ https://github.com/Chocapikk/CVE-2023-6553.git · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-6553 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64 · Patch
• https://bdu.fstec.ru/vul/2023-08960 · Security Note
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118 · Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62 · Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6553 · Security Note
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38 · Patch
• https://safe-surf.ru/upload/VULN-new/VULN.2023-12-15.1.pdf · Security Note
• https://twitter.com/latestly/status/1734936471084364095 · Twitter Post
• https://t.me/proxy_bar/1866 · Telegram Post