What the vulnerability does
01Description
The Backup Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.6 via deserialization of untrusted input in the 'recursive_unserialize_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must create a staging site in order to trigger the exploit.
Explanation of Vulnerability in Simple Terms
02Summary
BackupBliss versions up to 1.4.6 contain a deserialization vulnerability that allows an attacker to execute arbitrary code on the site. The vulnerability requires user interaction—typically clicking a malicious link or visiting a compromised page. An attacker can read sensitive data, modify site content, or disrupt service availability.
What an attacker can do
03Attacker Capabilities
Run arbitrary code on the site, read sensitive data, modify content, or cause the site to become unavailable.
Potential impact on your site
04Site Impact
Site could be fully compromised, including data theft, defacement, or downtime, if a user clicks a malicious link.
Conditions required to exploit
05Prerequisites
User interaction required (victim must click a link or visit a page). No authentication needed. Network access only.
Key dates
06Disclosure timeline
January 4, 2025
CVE published
April 8, 2026
Record updated
