Backup Migration Plugin: Data Leak Threatens WordPress Sites (CVE-2023-54346)

Step by step
How the attack unfolded
Click a phase for details – or let the animation play through.
PHASE 1/6 · Reconnaissance & Target Selection

Attackers use Google Dorks to automatically hunt for vulnerable WordPress sites running the Backup Migration plugin.

T1595 – Active Scanning T1595.003 – Wordlist Scanning
  • Target pool: over 90,000 active installations worldwide
  • Vulnerable: all versions up to and including 1.2.8 (CVE-2023-54346)
  • Mass scanning trivially automatable, regardless of traffic or popularity
PHASE 2/6 · Version Fingerprinting

Via the publicly accessible readme.txt the attacker reads out the installed plugin version.

T1592.002 – Gather Victim Host Information: Software
  • Requests /wp-content/plugins/backup-backup/readme.txt
  • Entry 'Stable tag: 1.2.8' reveals the vulnerable version
  • No authentication or special software required
PHASE 3/6 · Exploitation

The attacker reads unprotected config and log files to reconstruct the path to the backup archive.

T1190 – Exploit Public-Facing Application
  • config.json reveals the random backup directory name and admin email
  • complete_logs.log discloses the exact backup file name
  • CWE-538: sensitive data in an externally accessible directory
  • Public PoC available since May 2023 (EDB-51445 by Wadeek)
PHASE 4/6 · Collection

Using the gathered information the complete backup archive containing the database dump is targeted.

T1213 – Data from Information Repositories
  • Backup ZIP contains a full database dump
  • Content: usernames, email addresses, hashed passwords, session tokens
  • Additionally: order data, comments, contact form entries
  • Random directory name offers no protection (exposed in config.json)
PHASE 5/6 · Exfiltration

The attacker downloads the complete backup archive directly via a simple unauthenticated HTTP request.

T1567 – Exfiltration Over Web Service
  • Only four browser requests needed for the full chain
  • No password, no login required
  • Entire attack chain trivially automatable
  • No virtual patch possible (per Patchstack)
PHASE 6/6 · Impact

Stolen credentials and session tokens enable account takeover and reportable data breaches.

T1078 – Valid Accounts
  • Full database copy incl. user credentials in attacker's hands
  • CVSS 3.1: 7.5 (High), CVSS 4.0: 8.7 (High)
  • GDPR breach notification duty under Art. 33 applies
  • Median time to mass exploitation of top-attacked flaws: only 5 hours
Short & clear answers
Frequently asked questions about this incident
Am I affected by the Backup Migration vulnerability (CVE-2023-54346)?
All WordPress sites running the Backup Migration plugin version 1.2.8 or older are affected. Check the version number under "Plugins → Installed Plugins" or open https://your-domain.com/wp-content/plugins/backup-backup/readme.txt in your browser. If the config.json file under /wp-content/backup-migration/ shows JSON content instead of an error, the flaw is actively exploitable.
What do I need to do right now?
Update the plugin immediately – the fix has been available since version 1.2.9, and the current stable version is 2.1.6. If an immediate update isn't possible, deactivate or uninstall the plugin. Additionally, remove existing backup files from the publicly accessible directory and block the /wp-content/backup-migration/ folder at the server level (e.g. via .htaccess with "Deny from all").
What data can an attacker steal?
A WordPress backup typically contains a full database dump including usernames, email addresses, hashed passwords, session tokens, order data, comments and contact form entries. An attacker can download this data without any login using just four browser requests. This puts all stored content and credentials of your site at risk.
How can I tell if my site has already been attacked?
Check your web server's access logs (Apache/Nginx) for GET requests to config.json, complete_logs.log and backup ZIP files. Several consecutive requests from the same IP address are a strong indicator of an active attack. If you suspect a compromise, immediately change all passwords (WordPress admin, database, FTP, hosting).
Is a firewall or virtual patch enough protection?
No. Patchstack explicitly states that no virtual patch can be applied to this vulnerability, because it stems from missing file access control. Only updating to version 1.2.9 or higher, deactivating the plugin, or manually blocking the directory at the server level provides reliable protection.
More security news
You might also be interested in
Critical Elementor Pro Flaw: Attackers Can Fully Take Over WordPress Sites
A file upload bug in Elementor Pro up to 4.2.1 allows RCE without login. Version 4.2.2 fixes the flaw – update now!
Pods Plugin: Critical Flaw Enables Admin Takeover, No Login
A critical flaw in the WordPress plugin Pods lets attackers overwrite admin passwords without login. Over 100,000 sites are affected.
miniOrange SAML SSO: Critical Bypass Turns Attackers Into Admins
Two critical auth bypasses in the miniOrange SAML SSO plugin allow forged SAML assertions—up to full WordPress admin access.