Published on 5 August 2026
Four simple browser requests – that's all an attacker needs to download the entire database of your WordPress website. No password, no login, no special software. That's exactly what a vulnerability in the widely used WordPress plugin Backup Migration makes possible. On 3 August 2026, the security provider Patchstack published a high-priority alert and explicitly warns of mass exploitation. Anyone running an old version of this plugin should act now – not tomorrow.
The Backup Migration plugin (technical name: backup-backup, developer BackupBliss / Inisev) is used to create and migrate backup copies of a WordPress website. All versions up to and including 1.2.8 contain a vulnerability tracked under the identifier CVE-2023-54346 and rated with a CVSS score of 7.5 (High) under CVSS 3.1 – under the newer CVSS 4.0 standard, VulnCheck even assigns 8.7 (High). (CVE stands for "Common Vulnerabilities and Exposures", an internationally standardised numbering system for security vulnerabilities; the CVSS score rates the severity on a scale from 0 to 10.)
The problem sounds technical but is quickly explained: the plugin stores its configuration file, its log files and the finished backup archives in directories that are directly accessible over the internet without any access control. A backup of a WordPress website typically contains a complete database dump – meaning usernames, email addresses, encrypted (hashed) passwords, order data, comments and contact form entries. An attacker can simply download all of this.
Particularly explosive: a public "proof of concept" – i.e. a working example exploit – has been freely available since May 2023 (EDB-51445 on Exploit-DB, discovered by security researcher Wadeek). The formal CVE assignment only occurred on 5 May 2026, the Patchstack alert on 3 August 2026. This long time span means that many installations may still be unpatched today – while the attack vector has been known for years.
The vulnerability is classified as CWE-538 – meaning "Insertion of Sensitive Information into Externally-Accessible Directory". Specifically, the attack runs in four steps, all of which work without any login:
/wp-content/plugins/backup-backup/readme.txt and reads off which plugin version is installed – for example "Stable tag: 1.2.8"./wp-content/backup-migration/config.json, they obtain the randomly generated name of the backup directory as well as the email address of the website administrator./wp-content/backup-migration/complete_logs.log reveals the exact filename of the created backup archive.The trick of giving the backup directory a random name offers no protection – because this very random name is right there in the freely accessible config.json. The security analysis platform ZeroPath puts it in a nutshell:
"The entire security model collapses the moment an attacker reads the config.json. A single unauthenticated HTTP request chain can hand an attacker a complete copy of your database – including user credentials, session tokens and all stored content."
– ZeroPath CVE Analysis
The entire attack chain is trivially automatable. Attackers can use so-called "Google Dorks" – specially crafted search queries – to target vulnerable websites and harvest them on a large scale. That's exactly what Patchstack is warning about.
According to Wordfence and Qualys, the Backup Migration plugin has over 90,000 active installations worldwide. Affected are all websites running version 1.2.8 or older.
For German SMEs the vulnerability is particularly relevant: according to W3Techs, as of July 2026 WordPress powers around 41.5% of all websites worldwide and is also by far the most widely used content management system in Germany. Backup plugins are among the most frequently installed extensions – after all, every responsible operator wants backup copies of their website. And it is precisely this security tool that becomes the gateway here.
To put the danger in the WordPress ecosystem in general into perspective: in 2025, Patchstack recorded a total of 11,334 new vulnerabilities – an increase of 42% over the previous year. 91% of these vulnerabilities reside in plugins. And for the most heavily attacked vulnerabilities, the median time from disclosure to first mass exploitation is just five hours.
https://your-domain.com/wp-admin) and go to "Plugins → Installed Plugins". Look for "Backup Migration" and check the version number. If it is 1.2.8 or older, your website is vulnerable.https://your-domain.com/wp-content/plugins/backup-backup/readme.txt. If the page shows "Stable tag: 1.2.8" (or older), the plugin is installed and exploitable.https://your-domain.com/wp-content/backup-migration/config.json. If JSON content appears there (instead of a 403 or 404 error), the vulnerability is actively exploitable.https://your-domain.com/wp-content/backup-migration/complete_logs.log. If log entries with backup filenames are visible here, attackers can download the archives directly.Important note upfront: For this particular vulnerability, Patchstack cannot provide a virtual patch. A virtual patch is normally a protection rule at the level of a web application firewall that shields a vulnerability without the plugin itself having to be updated. Here that doesn't work due to the nature of the vulnerability (missing access control on files). This means: only an update or a manual block will protect you reliably.
https://downloads.wordpress.org/plugin/backup-backup.zip..htaccess file with the content Deny from all in the folder /wp-content/backup-migration/. On Nginx, configure the corresponding location directives.config.json, complete_logs.log and backup ZIP files. If you suspect a compromise, change all passwords immediately (WordPress admin, database, FTP, hosting).If an attacker actually downloads one of your backups, this constitutes a personal data breach – because database dumps generally contain usernames, email addresses, hashed passwords and, depending on the website, order or contact details.
Notification obligation (Art. 33 GDPR): As the data controller, you must report such a data breach without undue delay, ideally within 72 hours of becoming aware of it, to the competent state data protection authority (in Germany, for example, the LfDI, the LDI NRW or the BayLDA). The notification must include the nature and scope of the affected data, the approximate number of data subjects concerned, the likely consequences and the measures taken.
Communication obligation (Art. 34 GDPR): If there is a high risk to the rights and freedoms of the data subjects – for example in the case of exposed passwords or payment data – you must additionally inform the affected individuals themselves.
Fines (Art. 83 GDPR): Violations of technical protection measures (Art. 32 GDPR) can result in fines of up to €10 million or 2% of global annual turnover, and for serious violations up to €20 million or 4%. Importantly: according to current enforcement practice (Gibson Dunn, February 2026), supervisory authorities are increasingly sanctioning not only the data breach itself but already the absence of appropriate technical protection measures – i.e. also the failure to apply plugin updates. For SMEs this means: even without a demonstrable specific harm, the failure to apply available updates can be assessed as a violation of Art. 32 GDPR.
The risk must be classified as HIGH for all operators running version 1.2.8 or older. The reasons:
Patchstack states the danger unambiguously in its alert:
"This vulnerability is highly dangerous and is expected to be exploited. Vulnerabilities like this are used in mass-exploit campaigns. Attackers use them to attack thousands of websites simultaneously – regardless of visitor numbers or prominence."
– Patchstack
Another alarming context: according to the Verizon Data Breach Investigations Report 2026, exploited vulnerabilities have become the most common initial attack vector for data breaches for the first time in 19 years (31% of all incidents). According to IBM, the average cost of a data breach stands at USD 4.44 million. And: in Patchstack tests in 2025, typical hosting protection measures blocked only 12% of WordPress-specific attacks. Relying on the hosting provider is therefore not enough.
As a reminder that this plugin is not an isolated case: Backup Migration was already the target of a second critical vulnerability – CVE-2023-6553 (CVSS 9.8, remote code execution in version 1.3.7), which was actively exploited in large-scale campaigns.
CVE-2023-54346 is a textbook example of how a security tool itself becomes a security risk: of all things, the backups that are supposed to save you in an emergency lie unprotected, ready for any attacker. The good news: the patch has existed for years, and the update is applied in a matter of minutes. The bad news: without this update you are defenceless, because a firewall rule cannot intercept this vulnerability.
Check now whether you are running the Backup Migration plugin in version 1.2.8 or older. If so, update to the current version 2.1.6 today – or deactivate the plugin until you can get around to it. Additionally block the backup directory at server level and remove old backups from publicly accessible folders. And if your check reveals that the vulnerability has already been exploited: remember your 72-hour notification deadline under Art. 33 GDPR. In IT security, hours often make the difference – with this vulnerability, five, if in doubt.