Backupbliss vulnerabilities
We track 5 vulnerabilities in Backupbliss products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on May 5, 2026.
Latest Backupbliss vulnerabilities
- 7.5 High severity
WordPress Plugin Backup Migration: Insertion of Sensitive Information into Externally-Accessible File or Directory
WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file paths. Attackers can enumerate backup directories through configu
- 7.5 High severity
BackupBliss – Backup & Migration with Free…: Files or Directories Accessible to External Parties
The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the BMI_BACKUP case of the handle_downloading function in all versions up to, and including, 1.3.6. This makes it possible fo
- 7.2 High severity
BackupBliss – Backup & Migration with Free…: Improper Neutralization of Special Elements used in an OS Command
The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute a
- 9.8 Critical severity
BackupBliss – Backup & Migration with Free…: Improper Limitation of a Pathname to a Restricted Directory
The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possibl
- 9.8 Critical severity
BackupBliss – Backup & Migration with Free…: Improper Control of Generation of Code
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subseque