PT-2025-47884 · WordPress · Backup Migration

Ymmfty0 · CVE-2025-12394 · Published 2025-11-24 · Updated 2025-11-24

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Backup Migration WordPress plugin versions prior to 2.0.0

Description The Backup Migration WordPress plugin does not correctly create its backup path under specific server setups. This allows users without authorization to access a log file that reveals the backup filename. Subsequently, the backup archive can be downloaded without authentication.

Recommendations Update the Backup Migration WordPress plugin to version 2.0.0 or later.

Exploit

Fix

Related Identifiers

CVE-2025-12394

Affected Products

Backup Migration

References · 7

• 🔥 https://wpscan.com/vulnerability/e61293d0-2e1b-4dac-96c5-97fa17e38b16 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12394 · Security Note
• https://twitter.com/VulmonFeeds/status/1992869347623072090 · Twitter Post
• https://twitter.com/CVEnew/status/1992848972289810557 · Twitter Post
• https://t.me/cveNotify/143755 · Telegram Post
• https://t.me/CVEtracker/38056 · Telegram Post
• https://t.me/cveNotify/143742 · Telegram Post