CVE-2025-12394
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-25

Assigner: WPScan

Description
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-24
Last Modified
2025-11-25
Generated
2026-06-16
AI Q&A
2025-11-24
EPSS Evaluated
2026-06-15
NVD
CVE-2025-12394
EUVD
EUVD-2025-198621
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wordpress backup_migration *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The Backup Migration WordPress plugin before version 2.0.0 has a flaw where it does not correctly generate its backup path on certain server setups. This allows unauthenticated users to access a log file that reveals the backup filename. Once the filename is known, the backup archive can be downloaded without needing to log in.

Impact Analysis

This vulnerability can lead to unauthorized access to backup archives of your WordPress site. An attacker could download sensitive data contained in the backups without authentication, potentially exposing confidential information and compromising the security of your website.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12394. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart