CVE-2023-6266
Info Disclosure in Backupbliss Backup Migration ≤ 1.3.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-6266 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Backupbliss Backup Migration. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Automated Collection (T1119); ranked in the top 19% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The Backup Migration plugin for WordPress contains an information disclosure vulnerability caused by insufficient path and file validation in the BMI_BACKUP case of the handle_downloading function. The flaw affects all versions through 1.3.6 and is tracked under CWE-200 and CWE-552. An unauthenticated network attacker can directly request arbitrary backup archives without any credentials or user interaction, resulting in a CVSS 3.1 score of 7.5.
Because the plugin exposes a download handler that accepts attacker-controlled parameters, any remote adversary can retrieve full backup files. These archives commonly contain WordPress database credentials, user password hashes, personally identifiable information, and other sensitive site data, allowing subsequent account takeover or further compromise of the affected installation and any connected services.
The referenced Wordfence advisory and WordPress plugin repository revisions indicate that the issue was addressed by improved input validation in version 1.3.7. Site administrators are advised to update immediately and to restrict or remove the plugin if backups are not required. The associated EPSS score has reached a peak of 0.3202 with a current value of 0.2946, indicating moderate and sustained exploitation interest following disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58511
Vulnerability Data
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible…
more
for unauthenticated attackers to download back-up files which can contain sensitive information such as user passwords, PII, database credentials, and much more.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 5 hardening rules · 2 OS baselines
V8.4.2
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized actors from obtaining sensitive information.
Information flow enforcement structurally prevents sensitive data from reaching unauthorized recipients.
Protection of information at rest prevents unauthorized exposure of stored sensitive data.
Transmission confidentiality mechanisms stop exposure of sensitive data on the wire.
Least privilege reduces the set of actors who can reach sensitive information.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing least-privilege permissions and authorization policies directly prevents unauthorized file/directory exposure.
Data-at-rest protections such as encryption or ACLs reduce the impact of unintended file exposure.
Logical segmentation and access protections stop external parties from reaching files that should remain internal.
Hardened configuration baselines commonly include file-system permission settings that limit external access.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing classification and other controls; per the owner's explicit rule on labelling and similar dependency-style clauses, this does not itself prevent exposure (CWE-200) unless access/DLP/etc. act on it.
Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.
A.5.12 only defines and communicates a classification scheme so that protection needs can be understood; per the owner's explicit rule, labeling/classification does not itself prevent exposure and requires other controls (e.g. access enforcement) to act on it.
By requiring classification labels and metadata on all information assets, the control makes it harder for sensitive data to be inadvertently exposed because downstream systems and users can recognize and enforce handling rules based on those labels.
Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248579 OL 8 must restrict access to the kernel message buffer. blocks CWE-552
- V-248597 There must be no "shosts.equiv" files on the OL 8 operating system. blocks CWE-552