Open Nav
Sign Up

Critical Vulnerability in WordPress Backup Plugin – CVE-2023-6553

Critical Vulnerability CVE-2023-6553

Bar Refael

December 12, 2023

A critical vulnerability, designated CVE-2023-6553, has been identified in the widely used WordPress plugin “Backup Migration,” impacting over 90,000 installations. This vulnerability poses a critical risk of 9.8 out of 10 and could allow an unauthenticated attacker to conduct remote code execution (RCE) attacks against an affected website. Despite timely patch releases, a significant number of websites remain vulnerable.

Vulnerability Details

  • Plugin: Backup Migration
  • Affected Versions: Up to and including 1.3.6
  • Vulnerability ID: CVE-2023-6553
  • Severity Score: 9.8/10 (Critical)
  • Discovery: Nex Team, reported via Wordfence’s bug bounty program
  • Impact: Remote Code Execution through PHP code injection

Technical Analysis

The vulnerability allows attackers to inject and execute arbitrary PHP code remotely. This is facilitated through the /includes/backup-heart.php file, where an attacker can manipulate the content-dir HTTP header to control the BMI_ROOT_DIR variable. This manipulation leads to the inclusion of malicious PHP code, granting attackers full control over the targeted WordPress site.

Mitigation Steps

  1. Immediate Update Required: WordPress site administrators must upgrade to the latest version of the Backup Migration plugin (1.3.8 or later).
  2. Verify Plugin Integrity: Ensure no unauthorized modifications have been made to the plugin files, especially /includes/backup-heart.php.
  3. Monitor for Suspicious Activity: Regularly check for signs of compromise or unusual activities on the website.
  4. Regularly Update All Plugins: Keep all WordPress plugins and the core system updated to prevent exploitation of known vulnerabilities.

Related Threats

  • Phishing Campaign: Concurrently, a phishing campaign is targeting WordPress administrators, luring them to install malicious plugins using fake security advisories.
  • Additional WordPress Vulnerability: A recent Property Oriented Programming (POP) chain vulnerability in WordPress could also lead to arbitrary PHP code execution in certain conditions.

Conclusion

The discovery of CVE-2023-6553 underscores the critical importance of timely updates and continuous security monitoring in the WordPress ecosystem. Given the high severity of this vulnerability and the active exploitation of WordPress sites, immediate action is required to secure potentially vulnerable sites and prevent potential compromises.

Recommendations for Administrators

  • Update the Backup Migration plugin immediately.
  • Stay vigilant against phishing attempts.
  • Regularly update and audit all WordPress components.
  • Monitor for unusual site behavior or unauthorized changes.

Intelligence Source Attribution

This CTI report is based on information provided by Wordfence and corroborated by subsequent security advisories and patch release details from BackupBliss, the developers behind Backup Migration.

Stay safe and informed

Resources highlights

Docker Issues Patch for Critical Exploit in Docker Desktop: CVE-2025-9074

On August 20, 2025, Docker released an urgent patch for CVE-2025-9074, a critical Server-Side Request Forgery (SSRF) vulnerability (CVSS 9.3) affecting Docker Desktop for Windows…

Read more >

CVE-2025-9074

CVE-2025-48384: Git Submodule Path Flaw Exploited in the Wild

CVE-2025-48384 is a client-side Git vulnerability that lets a malicious repository abuse a mismatch in how Git reads vs. writes configuration values containing a trailing…

Read more >

CVE-2025-48384

CVE-2025-43300: Apple ImageIO Zero-Day Exploited in Targeted Attacks

Apple patched CVE-2025-43300, a zero-day in the ImageIO framework used system-wide to read/write many image formats. Opening or previewing a malicious image can corrupt memory…

Read more >

CVE-2025-43300

CVE-2025-57790: Commvault Path Traversal Vulnerability Leads to RCE

On August 19th, Commvault published advisory CV_2025_08_2 for a newly-discovered path traversal flaw in the Web Server component that allows remote attackers to perform unauthorized…

Read more >

CVE-2025-57790

CVE-2025-20265: Cisco Secure Firewall Management Center (FMC) RADIUS Pre-Auth RCE

A critical (CVSS 10.0)  input-handling flaw in the RADIUS authentication subsystem of Cisco Secure Firewall Management Center (FMC), tracked as CVE-2025-20265 allows unauthenticated remote code…

Read more >

CVE-2025-20265

5 Signs You’ve Outgrown Your Current Pentest Provider

As a CISO, CTO, or security leader, you understand the value of regular penetration testing. However, as your company scales and your security program matures,…

Read more >

5 signs PT provider
Under Cyber Attack?

Fill out the form and we will contact you immediately.