CVE-2026-39480: WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability

Synopsis

An unauthenticated sensitive data exposure vulnerability affects the Backup Migration WordPress plugin at version 2.1.1 and earlier. The flaw is reachable over the network with no credentials required and no user interaction needed, meaning any remote party with HTTP access to the site can trigger it. Successful exploitation gives an attacker read access to sensitive data stored or handled by the plugin, such as backup archives or configuration details. HarborGuard tracks this advisory for patch availability and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or credential of any privilege level is needed; the exposure is accessible to any anonymous requester.

• Victim interactionNot required

  The attacker does not need to trick or wait on any user action; the request can be made entirely without victim participation.

• Attack complexityDetail

  Exploit complexity is low, meaning no special conditions, race conditions, or environmental factors need to align for the attack to succeed reliably.

Blast Radius

• An attacker reads sensitive data managed by the Backup Migration plugin, which may include full backup archives containing the WordPress database, user credentials, and uploaded media.
• Exposed backup files can contain wp-config.php contents, leaking database credentials and secret authentication keys used by the WordPress installation.
• Access to a full site backup gives an attacker an offline copy of all stored user records, including email addresses, hashed passwords, and any personally identifiable information held in the database.