Search
Find a vulnerability
Search criteria
2 vulnerabilities found for WebToffee WP Backup and Migration by webtoffee
CVE-2026-120530 (GCVE-0-2026-120530)
Vulnerability from cvelistv5 – Published: 2026-11-07 06:39 – Updated: 2026-11-08 19:05
VLAI
EPSS
VEX
Title
WebToffee WP Backup and Migration <= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography
Summary
The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to generic SQL Injection via the 'description' parameter in all versions up to, and including, 1.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires an administrator to subsequently perform the plugin's ordinary local database export and restore operation on the same site, which is this plugin's primary intended function. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-08 18:47 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command
Assigner
Wordfence
CNA
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| webtoffee | WebToffee WP Backup and Migration |
Affected:
0 , ≤ 1.6.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-08T18:47:54.881792Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-08T19:05:23.642Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WebToffee WP Backup and Migration",
"vendor": "webtoffee",
"versions": [
{
"lessThanOrEqual": "1.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "zickzick2"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WebToffee WP Backup and Migration plugin for WordPress is vulnerable to generic SQL Injection via the \u0027description\u0027 parameter in all versions up to, and including, 1.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Successful exploitation requires an administrator to subsequently perform the plugin\u0027s ordinary local database export and restore operation on the same site, which is this plugin\u0027s primary intended function. Successful exploitation additionally requires an action by an administrator \u2014 the attacker cannot trigger the vulnerability on their own."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T06:39:39.172Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/99a088c5-866e-4a7c-aa82-8ad3123918d6?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-migration-duplicator/tags/1.6.1/admin/modules/import/import.php#L342"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-migration-duplicator/tags/1.6.1/admin/modules/import/import.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-migration-duplicator/tags/1.6.1/admin/modules/export/export.php#L957"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-migration-duplicator/tags/1.6.1/admin/modules/import/import.php#L875"
},
{
"url": "https://plugins.trac.wordpress.org/browser/wp-migration-duplicator?rev=3785443"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3785443/wp-migration-duplicator/trunk/admin/modules/import/import.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-29T17:59:18.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-11-06T18:36:17.000Z",
"value": "Disclosed"
}
],
"title": "WebToffee WP Backup and Migration \u003c= 1.6.1 - Authenticated (Subscriber+) SQL Injection via User Profile Biography"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-120530",
"datePublished": "2026-11-07T06:39:39.172Z",
"dateReserved": "2026-11-02T16:18:59.889Z",
"dateUpdated": "2026-11-08T19:05:23.642Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-3546 (GCVE-0-2024-3546)
Vulnerability from cvelistv5 – Published: 2024-05-02 16:51 – Updated: 2026-04-08 16:45
VLAI
EPSS
VEX
Title
WordPress Backup & Migration <= 1.4.8 - Missing Authorization to Directory Traversal
Summary
The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-20 15:09 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
Wordfence
CNA
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| webtoffee | WebToffee WP Backup and Migration |
Affected:
0 , ≤ 1.4.8
(semver)
|
|
| webtoffee | backup_and_migration |
Affected:
0 , ≤ 1.4.8
(custom)
cpe:2.3:a:webtoffee:backup_and_migration:*:*:*:*:*:wordpress:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:webtoffee:backup_and_migration:*:*:*:*:*:wordpress:*:*"
],
"defaultStatus": "unknown",
"product": "backup_and_migration",
"vendor": "webtoffee",
"versions": [
{
"lessThanOrEqual": "1.4.8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-3546",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-20T15:09:44.796648Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-06T19:20:08.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T20:12:07.631Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/339c4eba-fa34-4db6-be4b-bcf0ba98121a?source=cve"
},
{
"tags": [
"x_transferred"
],
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3073573%40wp-migration-duplicator%2Ftrunk\u0026old=3049128%40wp-migration-duplicator%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "WebToffee WP Backup and Migration",
"vendor": "webtoffee",
"versions": [
{
"lessThanOrEqual": "1.4.8",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Krzysztof Zaj\u0105c"
}
],
"descriptions": [
{
"lang": "en",
"value": "The WordPress Backup \u0026 Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:45:31.512Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/339c4eba-fa34-4db6-be4b-bcf0ba98121a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3073573%40wp-migration-duplicator%2Ftrunk\u0026old=3049128%40wp-migration-duplicator%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2024-04-22T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "WordPress Backup \u0026 Migration \u003c= 1.4.8 - Missing Authorization to Directory Traversal"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2024-3546",
"datePublished": "2024-05-02T16:51:57.352Z",
"dateReserved": "2024-04-09T19:09:13.577Z",
"dateUpdated": "2026-04-08T16:45:31.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}