UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-127050

Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback

Severity
High 7.1
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
2.1.8
Weakness
Path traversal (CWE-22)
Attack
Over the network · Only under certain conditions · Needs an administrator account · Needs someone to click or open something
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing ".." sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution.

From the CVE Program.

Affected software

SoftwareAffected versions
Backup Backup (WordPress plugin)WordPress plugins · wp-plugin:backup-backup
  • Every version before 2.1.8

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-127050