CVE-2026-7693: WordPress Backup Migration RCE Vulnerability

CVE-2026-7693 Overview

CVE-2026-7693 is an OS Command Injection vulnerability [CWE-77] in the Backup Migration plugin for WordPress, affecting all versions up to and including 2.1.5.1. The flaw resides in the restoreBackup() AJAX handler, which passes the attacker-controlled file POST parameter into an exec() call after applying only esc_attr() sanitization. Authenticated attackers with Administrator-level access, or any user granted the plugin's do_backups capability, can execute arbitrary OS commands as the web-server user. The issue bypasses WordPress hardening constants such as DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS.

Critical Impact
Authenticated attackers can achieve remote OS command execution as the web-server user, bypassing WordPress hardening controls designed to prevent code execution from the admin UI.

Affected Products

Backup Migration plugin for WordPress, versions up to and including 2.1.5.1
WordPress sites where any role holds the plugin's do_backups capability
Fixed in Backup Migration 2.1.5.2

Discovery Timeline

2026-08-05 - CVE-2026-7693 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-7693

Vulnerability Analysis

The Backup Migration plugin exposes an AJAX endpoint that resolves to restoreBackup() in includes/ajax.php. The handler reads the file POST parameter and passes it through esc_attr(), a WordPress helper designed to escape HTML attribute contexts. esc_attr() does not neutralize shell metacharacters such as `, $, ;, |, &, or newlines.

The sanitized value is then concatenated, unquoted, into a shell command of the form php-cli -f … bmi_restore <file> <remote> and passed to PHP's exec(). Because the argument is neither shell-quoted nor validated against a whitelist, an authenticated attacker can inject arbitrary shell syntax. Commands execute in the security context of the web-server user, providing a foothold for lateral movement, credential theft from wp-config.php, and persistence via cron or webshell drop.

The vulnerability specifically defeats DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS, hardening constants that many operators rely on to prevent code execution through the admin interface.

Root Cause

The root cause is the use of context-inappropriate sanitization. esc_attr() targets HTML attribute injection, not shell argument construction. The plugin also concatenates the unquoted parameter directly into a shell string rather than using escapeshellarg() or passing arguments via a safe API such as proc_open() with an array argv.

This is an incomplete fix of CVE-2023-7002. That earlier patch introduced rawurlencode(), explicit shell-metacharacter replacement, and double-quoting only in the $_POST['url'] branch of handleQuickMigration(). The equivalent mitigations were never applied to the $backupName variable used by restoreBackup().

Attack Vector

Exploitation requires an authenticated session with Administrator privileges or any role carrying the do_backups capability. The attacker issues a crafted POST request to the plugin's AJAX endpoint with a file value containing shell metacharacters, for example a backtick-wrapped command substitution or a semicolon-delimited secondary command. When the handler builds the php-cli command line, the injected payload is interpreted by the shell and executed alongside the intended restore invocation. See the Wordfence Vulnerability Report and the plugin source at includes/ajax.php#L3019 for the vulnerable code path.

Detection Methods for CVE-2026-7693

Indicators of Compromise

POST requests to admin-ajax.php invoking the plugin's restoreBackup action with shell metacharacters (`, $(, ;, |, &, \n) in the file parameter.
Child processes of the web-server user spawned from php-cli invoking bmi_restore with unusual argv, especially shells (sh, bash), network tools (curl, wget, nc), or interpreters.
Unexpected outbound connections from the web server following restore requests.
New or modified files under the WordPress webroot (webshells, altered wp-config.php) shortly after a restore AJAX call.

Detection Strategies

Inspect web-server access logs for admin-ajax.php requests whose body contains encoded shell metacharacters in the file parameter.
Correlate process-execution telemetry from the web-server user to identify shell or downloader processes descended from PHP.
Alert on Backup Migration plugin versions at or below 2.1.5.1 reported by site inventory or file-integrity monitoring.

Monitoring Recommendations

Enable audit logging of WordPress administrator actions and AJAX handler invocations for the plugin.
Ship web-server and PHP process telemetry to a central data lake for behavioral correlation.
Monitor for changes to wp-config.php, plugin files, and creation of unexpected PHP files in upload directories.

How to Mitigate CVE-2026-7693

Immediate Actions Required

Update the Backup Migration plugin to version 2.1.5.2 or later on all WordPress sites.
Audit user roles and remove the do_backups capability from any account that does not require it.
Rotate any credentials stored in wp-config.php if unauthorized restore activity is suspected.
Review recent admin-ajax.php traffic and web-server process history for signs of exploitation.

Patch Information

The vendor released Backup Migration 2.1.5.2, which addresses the unsafe handling of $backupName in restoreBackup(). Review the fix in the plugin changeset from 2.1.5.1 to 2.1.5.2. Operators who cannot upgrade immediately should treat all Administrator accounts as high-value and enforce strong authentication controls.

Workarounds

Restrict administrative access to trusted IP ranges at the reverse proxy or WAF layer.
Deploy WAF rules that block shell metacharacters in the file parameter of the plugin's AJAX endpoint.
Enforce multi-factor authentication for all WordPress Administrator accounts.
Temporarily deactivate the Backup Migration plugin on sites that cannot be patched.

bash

# Example WAF rule (ModSecurity) blocking shell metacharacters
# in the Backup Migration restore parameter
SecRule ARGS_POST:file "@rx [\`\$;\|\&\n]" \
    "id:1026693,phase:2,deny,status:403,\
    msg:'CVE-2026-7693 Backup Migration command injection attempt'"