What is CVE-2023-6971?

CVE-2023-6971 is a high-severity vulnerability in Backupbliss Backup Migration, classified under Inclusion of Functionality from Untrusted Control Sphere. CVSS score: 8.1/10. Published 2023-12-23.

How severe is CVE-2023-6971?

High severity. CVSS v3 base score is 8.1 out of 10.

Is CVE-2023-6971 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Backupbliss Backup Migration

CVE-2023-6971

The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the 'content-dir' HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server's php.ini is configured with 'allow_url_include' set to 'on'. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.

Published 2023-12-23 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.064 (93.5th percentile), scored 2026-09-29.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 93.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.064 · newest: 0.064 · change: 0.000

Affected products

Backupbliss Backup Migration
Migrate Backup Migration — versions 1.0.8

Weakness classification (CWE)

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere

Public proof-of-concept exploits

20142995/nuclei-templates

References

www.wordfence.com/threat-intel/vulnerabilities/id/b380283c-0dbb-4d67-9f66-cb7c4… (Patch, Third Party Advisory)
plugins.trac.wordpress.org/browser/backup-backup/tags/1.3.9/includes/backup-hea… (Patch)
plugins.trac.wordpress.org/changeset/3012745/backup-backup (Patch)

Frequently asked questions

What is CVE-2023-6971?: CVE-2023-6971 is a high-severity vulnerability in Backupbliss Backup Migration, classified under Inclusion of Functionality from Untrusted Control Sphere. CVSS score: 8.1/10. Published 2023-12-23.
How severe is CVE-2023-6971?: High severity. CVSS v3 base score is 8.1 out of 10.
Is CVE-2023-6971 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.