medium5.9
CVE-2025-12394
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users …
Impact
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
Affected products
| Product | Affected versions |
|---|---|
| Backup Migration WordPress Plugin | before 2.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.