CVE-2023-6971: Backupbliss Backup Migration

Critical severity, CVSS 9.8. EPSS: 6.4% chance of exploitation in the next 30 days.

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

Affected products

• Backupbliss Backup Migration: from 1.0.8, before 1.4.0 (fixed in 1.4.0)

Published 2023-12-23. Last modified 2026-06-17.