High · 7.5 CVE-2026-97197 EUVD-2026-89898GHSA-8j7x-hw6m-chvv

WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability

Published Sep 30, 2026 · Updated Sep 30, 2026 · Assigned by Patchstack

Vendor: WebToffee Product: WordPress Backup & Migration Category: Web / CMS

Description

Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

Affected products

Vendor	Product	Affected	Fixed
WebToffee	WordPress Backup & Migration	≤ 1.6.0	—

References

https://patchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve vdb-entry