CVE-2023-6553

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

• CWE-94

• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail=Patch
• https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-itNot Applicable
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cveThird Party Advisory
• http://packetstormsecurity.com/files/176638/WordPress-Backup-Migration-1.3.7-Remote-Command-Execution.html
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L118Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L38Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L62Patch
• https://plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.7/includes/backup-heart.php#L64Patch
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3006541%40backup-backup&new=3006541%40backup-backup&sfp_email=&sfph_mail=Patch
• https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-itNot Applicable
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3511ba64-56a3-43d7-8ab8-c6e40e3b686e?source=cveThird Party Advisory

Published

Dec 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6546A race condition was found in the GSM 0710 tty multiplexor i…7
• CVE-2023-6547Mattermost fails to validate team membership when a user att…5.4
• CVE-2023-6548Improper Control of Generation of Code ('Code Injection') in…8.8
• CVE-2023-6549Improper Restriction of Operations within the Bounds of a Me…7.5
• CVE-2023-6551As a simple library, class.upload.php does not perform an in…5.4
• CVE-2023-6552Lack of "current" GET parameter validation during the action…6.1
• CVE-2023-6554When access to the "admin" folder is not protected by some e…6.5
• CVE-2023-6555The Email Subscription Popup WordPress plugin before 1.2.20 …6.1
• CVE-2023-6556The FOX – Currency Switcher Professional for WooCommerce plu…5.4
• CVE-2023-6557The The Events Calendar plugin for WordPress is vulnerable t…5.3
• CVE-2023-6558The Export and Import Users and Customers plugin for WordPre…7.2
• CVE-2023-6559The MW WP Form plugin for WordPress is vulnerable to arbitra…9.8