CVE-2025-24651: WordPress Backup Migration Log Vulnerability

CVE-2025-24651 Overview

CVE-2025-24651 is a sensitive information disclosure vulnerability in the WebToffee WordPress Backup & Migration plugin (wp-migration-duplicator). The flaw is classified under [CWE-532] Insertion of Sensitive Information into Log File. Affected versions include all releases up to and including 1.5.3. An unauthenticated remote attacker can retrieve embedded sensitive data written to log files by the plugin during backup and migration operations. Successful exploitation exposes confidential information without requiring user interaction or authentication, though attack complexity is rated high.

Critical Impact
Unauthenticated attackers can retrieve sensitive data embedded in plugin log files, exposing site secrets and backup metadata that may accelerate follow-on attacks.

Affected Products

WebToffee WordPress Backup & Migration plugin (wp-migration-duplicator)
All versions from initial release through 1.5.3
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-04-17 - CVE-2025-24651 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24651

Vulnerability Analysis

The plugin writes sensitive information into log files during backup and migration operations. These log artifacts become accessible to unauthenticated actors who can locate and request them over the network. The exposure category [CWE-532] covers cases where an application records credentials, tokens, database contents, or configuration values into files that are not adequately protected.

Attackers exploiting this weakness do not need valid credentials or user interaction. The attack complexity is elevated because the actor must locate log paths and correlate accessible content, but the impact on confidentiality remains high. Integrity and availability of the site are not directly affected by this specific weakness.

Root Cause

The root cause is the plugin's logging routine embedding sensitive backup data, migration parameters, or environment values into files stored in web-accessible locations. Without adequate access controls, filename randomization, or content redaction, this data can be retrieved by remote parties who identify the log file location.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the vulnerable plugin. An attacker enumerates the plugin's log directory or file naming pattern, then issues HTTP requests to fetch the log content. The retrieved data can include backup metadata, path information, or embedded secrets that assist in further compromise of the WordPress installation.

See the Patchstack Vulnerability Report for additional technical detail.

Detection Methods for CVE-2025-24651

Indicators of Compromise

Unexpected HTTP GET requests targeting the wp-content/plugins/wp-migration-duplicator/ directory or its log subpaths.
Requests to files with extensions such as .log, .txt, or backup archive names originating from unfamiliar IP ranges.
Elevated response sizes for requests to plugin-owned static files, indicating log content retrieval.

Detection Strategies

Review web server access logs for anonymous access to plugin directories and any .log files served with a 200 status.
Deploy web application firewall rules that flag direct requests to plugin log paths or file listings under wp-content/plugins/wp-migration-duplicator/.
Inspect the plugin's own log directory for world-readable permissions and files containing credentials, tokens, or database dumps.

Monitoring Recommendations

Continuously monitor requests to wp-content/plugins/ paths and alert on access to non-PHP artifacts.
Correlate scanner-like enumeration patterns against WordPress plugin directories with subsequent login or admin activity.
Audit file permissions on plugin-generated log and backup files as a scheduled control.

How to Mitigate CVE-2025-24651

Immediate Actions Required

Upgrade the WebToffee WordPress Backup & Migration plugin to a version above 1.5.3 once released by the vendor.
Remove or relocate existing plugin log files from web-accessible directories, and rotate any credentials that may have been exposed.
Restrict direct HTTP access to plugin log files at the web server or WAF layer until a patched version is deployed.

Patch Information

The vulnerability affects WebToffee WordPress Backup & Migration versions through 1.5.3. Consult the Patchstack Vulnerability Report and the vendor's WordPress.org plugin page for the fixed release. Apply the latest patched version through the WordPress plugin manager and verify that log files created by prior versions are removed.

Workarounds

Add web server rules that deny requests to wp-content/plugins/wp-migration-duplicator/*.log and similar log file extensions.
Disable or uninstall the plugin until a patched version is available if backup functionality is not currently required.
Force strict filesystem permissions on plugin-generated log files so that only the web server user can read them.

bash

# Apache: block direct access to plugin log files
<FilesMatch "\.(log|txt)$">
  Require all denied
</FilesMatch>

# Nginx equivalent inside the site server block
location ~* /wp-content/plugins/wp-migration-duplicator/.*\.(log|txt)$ {
    deny all;
    return 403;
}