CVE-2023-54346
📛 CVE Title
WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download
Description
WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- VulnCheck
- CVSS severity
- HIGH
- CVSS score
- 8.7 / 10
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N- Effective score
- 8.7 / 10 HIGH source: CNA overview
- CWE(s)
-
CWE-538 - Reserved
- 2026-01-10
- Published
- 2026-05-05 13:24 UTC
- Last updated
- 2026-05-06 14:34 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2023/54xxx/CVE-2023-54346.json
- Linked Threat
- CVE-2023-54346 — Backup Migration <= 1.2.8 - Sensitive Information Exposure
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2023-60568 - Assigner
- VulnCheck
- Published
- May 5, 2026, 11:24:50 AM
- Updated
- May 6, 2026, 12:34:45 PM
- EUVD base score (CVSS 4.0)
-
8.7 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - EUVD-reported EPSS
- 0.0500
- Vendors
- Backupbliss
- Products
-
WordPress Plugin Backup Migration (1.2.8)
ENISA description: WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps.
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Backupbliss | WordPress Plugin Backup Migration |
1.2.8 (affected)
|
— |
Vendor references (4)
References embedded in the original CVE record by the assigning CNA.
- ExploitDB-51445 exploit
- Official Product Homepage product
- Product Reference product
- VulnCheck Advisory: WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download third-party-advisory
MITRE references (4) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
- Official Product Homepage product
- ExploitDB-51445 exploit
- Product Reference product
- VulnCheck Advisory: WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download third-party-advisory
Web references (3)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://www.cve.org/CVERecord?id=CVE-2023-54346 tenable:www.cve.org
- https://nvd.nist.gov/vuln/detail/CVE-2023-54346 tenable:nvd.nist.gov
- https://www.first.org/epss/ tenable:www.first.org
Indicators (1)
IOCs linked to the auto-promoted Threat row.
| Type | Value | VirusTotal | Attached |
|---|---|---|---|
| cve |
CVE-2023-54346
|
no local data | 2026-07-30 03:01 UTC |
Remediations (25)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
Wordfence remediation: Backup MigrationWordfence
Update to version 1.2.9, or a newer patched version
2026-07-30 03:01 UTC -
web:wa.me
Hosted by WhatsApp 2026 © WhatsApp LLC Privacy & Terms
2026-07-01 20:31 UTC -
web:www.grammarly.com
Grammarly makes AI writing convenient. Work smarter with personalized AI guidance and text generation on any app or website.
2026-07-01 20:31 UTC -
web:gemini.google.com
Meet Gemini, Google's AI assistant. Get help with writing, planning, brainstorming, and more. Experience the power of generative AI.
2026-07-01 20:31 UTC -
web:www.wikihow.com
Plus, learn how to fix tears and remove cloudinessHave you ever noticed tiny little "pimples" under the surface of your NeeDoh Nice Cube? These are actually air bubbles, and they tend to form when you stretch and pull on your Nice Cube a...
2026-07-01 20:31 UTC -
web:monkeypatcher.com
Monkeypatcher 🙈
2026-07-01 20:31 UTC -
web:www.moddb.com
Fixes black screen, crashes and allows online play on modern versions of Windows. If you use two factor authentication with your Microsoft account, use an "app password" instead of your normal password. Search "microsoft how to create a new app password...
2026-07-01 20:31 UTC -
web:u.jd.com
u.jd.com
2026-07-01 20:31 UTC -
web:catalog.update.microsoft.com
Welcome to the Microsoft Update Catalog site. We want your feedback! Visit our newsgroup or send us an email to provide us with your thoughts and suggestions. To get started using the site, enter in your search terms in the Search box above or visit our FAQ for search tips. |Newsgroup|Send us your feedback Accessibilité : partiellement conforme
2026-07-01 20:31 UTC -
web:www.bugcrowd.com
Vulnerability mitigation is typically considered a temporary or interim solution. While mitigation measures can reduce the immediate risk associated with vulnerabilities, they may not provide a permanent fix . Organizations should aim to prioritize and plan for complete vulnerability remediation whenever feasible and allocate resources accordingly.
2026-05-22 07:54 UTC -
web:cisa.gov
Update (08/12/2025): CISA has updated this alert to provide clarification on identifying Exchange Servers on an organization's networks and provided further guidance on running the Microsoft Exchange Health Checker. Update (08/07/2025): CISA issued Emergency Directive (ED) 25-02: Mitigate Microsoft Exchange Vulnerability in response to CVE -2025-53786
2026-05-22 07:54 UTC -
web:securityboulevard.com
Cybersecurity vulnerabilities pose significant risks to organizations in today's digital landscape. Left unaddressed, these vulnerabilities can lead to data breaches, financial losses, and reputational damage. Organizations must decide how to tackle vulnerabilities—through remediation , mitigation , or a combination of both. But which strategy is more effective? This blog explores the ...
2026-05-22 07:54 UTC -
web:www.rapid7.com
Remediation vs. mitigation : What are the differences? Once a vulnerability has been discovered, the ideal solution is to remediate it—to fix or patch the vulnerability before it can become a security threat.
2026-05-22 07:54 UTC -
web:www.secure.com
Learn the difference between vulnerability remediation and mitigation , and how a risk-based strategy can strengthen your security posture.
2026-05-22 07:54 UTC -
web:www.tenable.com
What is patch management? At its core, patch management is the formal process your organization uses to identify, acquire, test, and deploy software updates, or "patches," to your IT assets. Vendors release patches for several reasons: Fix software bugs Improve performance Add new features Fix vulnerabilities that attackers could otherwise exploit A patch can be a minor, single fix (a "hotfix ...
2026-05-22 07:54 UTC -
web:portal.msrc.microsoft.com
The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.
2026-05-22 03:28 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-22 03:28 UTC -
web:www.youtube.com
HOW TO FIX STEAM BLACK OPS 3! - Fixing T7 Patch , Clean Ops, and BO3 PC Client T7X (2026)
2026-05-22 03:28 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-22 03:28 UTC -
web:www.techrepublic.com
Meta patched two WhatsApp flaws affecting iOS, Android, and Windows users, including bugs tied to risky files, links, and Reels previews.
2026-05-22 03:28 UTC -
web:cybersecuritynews.com
Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.
2026-05-22 03:28 UTC -
web:krebsonsecurity.com
Microsoft expects that exploitation is more likely. May's Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.
2026-05-22 03:28 UTC -
web:access.redhat.com
Learn about our open source products, services, and company. You are here
2026-05-22 03:28 UTC -
web:www.cve.org
At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures
2026-05-22 03:28 UTC -
web:www.bleepingcomputer.com
Microsoft says customers in restricted network environments may encounter Windows Update failures after installing the January 2026 optional non-security preview updates.
2026-05-22 03:28 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2023-54346.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-54346",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-06T12:34:31.481556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-06T12:34:45.274Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "WordPress Plugin Backup Migration",
"vendor": "Backupbliss",
"versions": [
{
"status": "affected",
"version": "1.2.8"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wadeek"
}
],
"datePublic": "2023-05-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configuration files and complete logs, then construct direct download URLs to retrieve sensitive backup archives containing full database dumps."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-538",
"description": "Insertion of Sensitive Information into Externally-Accessible File or Directory",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-05T11:24:50.282Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "ExploitDB-51445",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/51445"
},
{
"name": "Official Product Homepage",
"tags": [
"product"
],
"url": "https://backupbliss.com/"
},
{
"name": "Product Reference",
"tags": [
"product"
],
"url": "https://downloads.wordpress.org/plugin/backup-backup.1.2.8.zip"
},
{
"name": "VulnCheck Advisory: WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/wordpress-plugin-backup-migration-unauthenticated-database-backup-download"
}
],
"title": "WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2023-54346",
"datePublished": "2026-05-05T11:24:50.282Z",
"dateReserved": "2026-01-10T01:51:52.985Z",
"dateUpdated": "2026-05-06T12:34:45.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}