High severity8.1NVD Advisory· Published Dec 23, 2023· Updated Jun 17, 2026

CVE-2023-6971

Description

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Backupbliss/Backup Migration2 versions
cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*+ 1 more
- cpe:2.3:a:backupbliss:backup_migration:*:*:*:*:*:wordpress:*:*range: >=1.0.8,<1.4.0
- (no CPE)range: 1.0.8
WordPress/Backup Migrationllm-fuzzy
Range: 1.0.8-1.3.9
Package: https://wordpress.org/plugins/backup-migration

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-heart.phpnvdPatch
plugins.trac.wordpress.org/changeset/3012745/backup-backupnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c400c0427nvdPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.005
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000