CVE-2025-14944mediumCWE-862

CVE-2025-14944: fallo de gravedad media en inisev BackupBliss – Backup & Migration with…

Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BackupBliss – Backup & Migration with Free Cloud Storage

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.6%
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
inisev · BackupBliss – Backup & Migration with Free Cloud Storage
CVEs relacionadas — inisev BackupBliss – Backup & Migration with…

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-6553CRITICALBackup Migration <= 1.3.7 - Unauthenticated Remote Code ExecutionEPSS 97.8%CVE-2023-7002HIGHBackup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via urlEPSS 30.8%CVE-2023-6266HIGHBackup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information ExposureEPSS 2.1%CVE-2023-6972CRITICALBackup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File DeletionEPSS 1.4%CVE-2024-10932HIGHBackup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'EPSS 0.8%CVE-2023-0958MEDIUMInisev Plugins (Various Versions) - Missing Authorization on handle_installation functionEPSS 0.7%