Introduction
A single unauthenticated HTTP request chain against the WordPress Backup Migration plugin can hand an attacker a complete copy of your site's database, including user credentials, session tokens, and every piece of stored content. The plugin has over 90,000 active installations, which makes CVE-2023-54346 a significant exposure across the WordPress ecosystem.
BackupBliss develops the Backup Migration plugin, which gives WordPress administrators tools to create, schedule, and manage site backups. It is one of the more popular backup plugins in the WordPress plugin directory, so a vulnerability like this one has a wide blast radius. Its reach also extends beyond individual sites, because managed hosting providers and agencies frequently deploy it across client portfolios.
Technical Information
CVE-2023-54346 is classified under CWE-538: Insertion of Sensitive Information into Externally Accessible File or Directory. The root cause is simple. The plugin stores its configuration files, operational logs, and backup archives in directories that are directly accessible over HTTP, and neither the web server nor the application enforces any authentication or authorization check on them.
The plugin writes a config.json file and a complete_logs.log file into the /wp-content/backup-migration/ directory. The config.json file contains the randomized directory name used for backup storage, along with the site administrator's email address. The complete_logs.log file records the exact filenames of created backup archives. The archives themselves sit in a subdirectory that follows the pattern /wp-content/backup-migration-[random_string]/backups/.
The directory name includes a random string, but that randomness provides no security, because the configuration file that reveals it is publicly accessible too. Once an attacker reads config.json, the entire security model collapses.
Attack Flow
The publicly documented exploit (EDB-51445) demonstrates a four-step unauthenticated attack chain:
- The attacker fingerprints the version by sending a GET request to the plugin's
readme.txt, confirming that a vulnerable version (1.2.8 or older) is installed. - The attacker requests the
config.jsonfile, which exposes the randomized backup storage directory name and the administrator's email address. - The attacker enumerates the logs by requesting the
complete_logs.logfile, which contains the exact filenames of all backup archives that have been created. - Using the directory name from step 2 and the archive filename from step 3, the attacker builds a direct download URL and retrieves the full database backup.
The request sequence looks like this:
GET /wp-content/plugins/backup-backup/readme.txt GET /wp-content/backup-migration/config.json GET /wp-content/backup-migration/complete_logs.log GET /wp-content/backup-migration-[random_string]/backups/BM_Backup_[date]_[time]_[random_string].zip
No step requires authentication. The whole chain is trivial to automate, and the resulting ZIP archive contains a full database dump. On a typical WordPress installation, that dump includes user tables with hashed passwords, email addresses, post content, plugin configuration data, and potentially stored API keys or other secrets.
Detection Methods
The attack chain follows a very specific multi-step HTTP request pattern, which gives defenders several practical ways to detect exploitation while it is in progress or after the fact.
Web Server Access Log Analysis
The most effective approach is to monitor web server access logs (Apache, Nginx, or WAF logs) for unauthenticated HTTP GET requests to these paths:
/wp-content/plugins/backup-backup/readme.txt(version fingerprinting)/wp-content/backup-migration/config.json(configuration exposure)/wp-content/backup-migration/complete_logs.log(log enumeration)/wp-content/backup-migration-<random>/backups/<backup_filename>.zip(backup exfiltration)
A single request to any of these paths from an unauthenticated user is suspicious. Sequential requests from the same source IP that hit these endpoints in order, often within a short time window, are a strong indicator of active exploitation. Security teams should build log correlation rules or SIEM queries that flag this pattern.
Web Application Firewall (WAF) Monitoring
Configure WAF rules to block or alert on unauthenticated access to the /wp-content/backup-migration/ directory tree. Pay special attention to requests for .json, .log, and .zip files within that path hierarchy. An HTTP 200 response to an unauthenticated user for any of these requests strongly indicates a vulnerable configuration or active exploitation.
Network-Level Indicators
Watch for unusually large outbound HTTP responses from your WordPress server, especially on paths that contain backup-migration. A successful exfiltration returns a full ZIP archive of the database, which is much larger than typical web traffic. Anomaly detection on the response sizes of requests to the wp-content directory can help catch this activity.
WordPress-Level Detection
Check the plugin's readme.txt file or the WordPress admin panel to see whether the Backup Migration plugin is installed at version 1.2.8 or below. If it is, immediately check whether the config.json and complete_logs.log files are publicly accessible. If they are, that confirms the exposure.
Reconnaissance Detection
The public exploit includes a Google dork that finds exposed instances by combining directory-listing titles for /wp-content/plugins/backup-backup with matching URL patterns. Inbound traffic whose Google referrer headers point to such searches may mean your site has been discovered through reconnaissance.
No Sigma rules, YARA rules, or IDS/Snort signatures dedicated to CVE-2023-54346 were identified in verified public sources.
Affected Systems and Versions
The vulnerability affects the WordPress Backup Migration plugin in the following versions:
| Plugin Version | Status |
|---|---|
| 1.2.8 and all older versions | Vulnerable to CVE-2023-54346 (Information Disclosure) |
| 1.2.9 | Patched for CVE-2023-54346 |
| 1.3.7 | Patched for CVE-2023-54346 but vulnerable to CVE-2023-6553 (Remote Code Execution) |
| 1.3.8 | Patched for CVE-2023-6553 |
| 2.1.5.1 | Current stable release |
Any WordPress installation running the Backup Migration plugin (slug: backup-backup) at version 1.2.8 or earlier is affected. The plugin is available through the official WordPress plugin directory and has over 90,000 active installations.
Vendor Security History
BackupBliss has a notable security track record with this plugin. After the information disclosure vulnerability in version 1.2.8, a separate critical vulnerability was discovered in version 1.3.7. That flaw, tracked as CVE-2023-6553, allowed unauthenticated remote code execution and carried a CVSS score of 9.8. Wordfence reported that it was actively blocking attacks targeting that RCE vulnerability.
Two high-severity unauthenticated vulnerabilities in the same plugin, discovered within a relatively short timeframe, form a pattern. Organizations that rely on this plugin should keep automated update policies in place and consider additional monitoring around its file paths.
References
- CVE Record: CVE-2023-54346
- VulnCheck Advisory: WordPress Plugin Backup Migration 1.2.8 Unauthenticated Database Backup Download
- Wordfence: Backup Migration <= 1.2.8 Sensitive Information Exposure
- Exploit-DB: WordPress Plugin Backup Migration 1.2.8 (EDB-51445)
- BackupBliss Vendor Site
- Backup Migration Plugin on WordPress.org
- Acunetix: WordPress Plugin Backup Migration Information Disclosure 1.2.8
- Wordfence: Backup Migration <= 1.3.7 Unauthenticated Remote Code Execution
- WordPress Plugin Archive: backup-backup 1.2.8
