CVE-2025-12394: Unknown Backup Migration

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.

Affected products

• Unknown Backup Migration: before 2.0.0 (fixed in 2.0.0)

Published 2025-11-24. Last modified 2026-10-08.