Threat Database

Threat Entry Updated 2026-06-17

WordPress Backup & Migration - Broken Access Control (CVE-2023-45636)

Missing Authorization vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through

PLUGIN WordPress Backup & Migration

CVE-2023-45636

MEDIUM CVSS 5.4 2025-01-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WordPress Backup & Migration - Broken Access Control (CVE-2023-33928)

Missing Authorization vulnerability in WebToffee WordPress Backup & Migration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Backup & Migration: from n/a through 1.4.0.

PLUGIN WordPress Backup & Migration

CVE-2023-33928

MEDIUM CVSS 4.3 2024-12-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WordPress Backup & Migration - Broken Access Control (CVE-2023-52183)

Missing Authorization vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.3.

PLUGIN WordPress Backup & Migration

CVE-2023-52183

MEDIUM CVSS 5.4 2024-06-11

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WordPress Backup & Migration - Broken Access Control (CVE-2024-3546)

The WordPress Backup & Migration plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the wp_mgdp_populate_popup function in all versions up to, and including, 1.4.8. This makes it possible for authenticated attackers, with subscriber access or above, to invoke this function and access log files maintained by the plugin. Additionally, the file name is user-provided and not properly sanitized, which allows attackers to read arbitrary log files on the file system.

PLUGIN WordPress Backup & Migration

CVE-2024-3546

MEDIUM CVSS 4.3 2024-05-02

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WordPress Backup & Migration - Cross-Site Scripting (XSS) (CVE-2023-5738)

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.

PLUGIN WordPress Backup & Migration

CVE-2023-5738

MEDIUM CVSS 5.4 2023-11-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WordPress Backup & Migration - Security Vulnerability (CVE-2023-5737)

The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.

PLUGIN WordPress Backup & Migration

CVE-2023-5737

MEDIUM CVSS 4.3 2023-11-27

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

WordPress Backup Migration - Cross-Site Scripting (XSS) (CVE-2021-36884)

Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin

PLUGIN WordPress Backup Migration

CVE-2021-36884

MEDIUM CVSS 4.8 2021-11-19

Risk Score

Open Full Technical Breakdown