CVE-2025-12394
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-24

Last updated on: 2025-11-25

Assigner: WPScan

Description
The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configurations, allowing unauthenticated users to fetch a log that discloses the backup filename. The backup archive is then downloadable without authentication.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-24
Last Modified
2025-11-25
Generated
2026-05-06
AI Q&A
2025-11-24
EPSS Evaluated
2026-05-05
NVD
CVE-2025-12394
EUVD
EUVD-2025-198621
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wordpress backup_migration *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

The Backup Migration WordPress plugin before version 2.0.0 has a flaw where it does not correctly generate its backup path on certain server setups. This allows unauthenticated users to access a log file that reveals the backup filename. Once the filename is known, the backup archive can be downloaded without needing to log in.


How can this vulnerability impact me? :

This vulnerability can lead to unauthorized access to backup archives of your WordPress site. An attacker could download sensitive data contained in the backups without authentication, potentially exposing confidential information and compromising the security of your website.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart