medium6.5
CVE-2026-18216
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one sit…
Impact
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Affected products
| Product | Affected versions |
|---|---|
| Backup Migration WordPress Plugin | before 2.1.7 |
Versions were read from the advisory text. No structured product data has been published for this record yet.