CVE-2025-14944

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.

• CWE-862

• https://plugins.trac.wordpress.org/browser/backup-backup/trunk/includes/ajax_offline.php#L112
• https://plugins.trac.wordpress.org/browser/backup-backup/trunk/includes/offline.php#L29
• https://plugins.trac.wordpress.org/changeset?old=3386897&old_path=backup-backup%2Ftags%2F2.0.0%2Fincludes%2Foffline.php&new=3449635&new_path=backup-backup%2Ftags%2F2.1.0%2Fincludes%2Foffline.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a41a15-0743-48cc-8c92-7cb839fa5847?source=cve

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14939A vulnerability was found in code-projects Online Appointmen…7.2
• CVE-2025-1494IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a …6.1
• CVE-2025-14940A vulnerability was determined in code-projects Scholars Tra…9.8
• CVE-2025-14941The GZSEO plugin for WordPress is vulnerable to authorizatio…6.4
• CVE-2025-14942wolfSSH’s key exchange state machine can be manipulated to l…9.8
• CVE-2025-14943The Blog2Social: Social Media Auto Post & Scheduler plugin f…4.3
• CVE-2025-14946A flaw was found in libnbd. A malicious actor could exploit …4.8
• CVE-2025-14947The All-in-One Video Gallery plugin for WordPress is vulnera…6.5
• CVE-2025-14948The miniOrange OTP Verification and SMS Notification for Woo…5.3
• CVE-2025-1495IBM Business Automation Workflow 24.0.0 and 24.0.1 through 2…4.3
• CVE-2025-14950A weakness has been identified in code-projects Scholars Tra…9.8
• CVE-2025-14951A security vulnerability has been detected in code-projects …9.8