Security Alert Summary
Backup Migration before 2.1.8 contains a path traversal vulnerability in its PclZip restore fallback. If an administrator restores a malicious backup archive on a server that lacks the PHP zip extension, an attacker can craft archive entries with “..” sequences that are extracted outside the intended directory. This can lead to arbitrary file write into the web-servable tree and potential remote code execution.
CVE Details
- CVE ID: CVE-2026-127050
- Affected component: Backup Migration plugin (PclZip restore fallback)
- Affected versions: Versions before 2.1.8 (less than 2.1.8)
- Published: November 12, 2026 at 01:17:16 PM
- Last modified: November 12, 2026 at 01:17:16 PM
- CVSS v3.1 base score: 6.4 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H - Authentication / privileges / interaction:
- Authentication requirements: administrator must initiate a restore
- Privileges required: High (requires administrator privileges)
- User interaction: Required (an administrator must perform the restore)
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- Weakness: CWE-22 (Path Traversal)
Technical Details
The plugin uses a PclZip-based restore fallback when the PHP zip extension is not available. PclZip’s extract() routine can process archive entry names containing “..” sequences. Because the fallback call does not use the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, entries can be written outside the intended extraction directory. An attacker-supplied malicious zip archive, when restored by an administrator, can therefore write files into the web-servable tree (for example PHP files), enabling remote code execution.
This issue exists specifically in the restore path that relies on PclZip rather than the native PHP zip extension; the vulnerability requires the fallback path to be used and an administrator to restore the crafted archive.
How This Could Impact Your Website
Consider a site where a site owner delegates backup restoration to internal staff or an external contractor. If an administrator or a trusted staff member restores a malicious backup archive (for example, an archive supplied by an external contractor or uploaded by a user with restoration access) on a server without the PHP zip extension, an attacker could cause files to be written into the web root. Practical consequences include disclosure of sensitive files, unauthorized modification of site files, or execution of arbitrary code that can read or exfiltrate data such as internal user email addresses.
Such an outcome increases the risk of targeted phishing or social engineering against staff and customers and may require removing malicious files and restoring the site from a known-good backup. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and restoration privileges.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and disable fallback restore paths where possible.
- Monitor site activity and file changes for unusual behavior after restores.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
