Vulnerability in Backup Migration
CVE-2026-18216
The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.
Affected products
- Unknown Backup Migration — versions 0
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)