OS Command Injection in Backup Migration WordPress Plugin

The Backup Migration plugin for WordPress, in all versions up to and including 2.1.5.1, contains an OS Command Injection vulnerability (CVE-2026-7693). This issue arises from improper sanitization of the 'file' POST parameter within the 'restoreBackup' AJAX handler. While the plugin employs 'esc_attr()' to sanitize input, this function is designed for HTML-context output and does not effectively strip shell metacharacters.

The application subsequently concatenates this unquoted input directly into a command string executed by the PHP 'exec()' function. This vulnerability serves as an incomplete fix for a previously identified issue (CVE-2023-7002), which had addressed similar patterns in other handlers but failed to secure this specific code path. Attackers possessing the 'do_backups' capability - typically assigned to administrators - can exploit this to run arbitrary OS commands as the web server user, effectively bypassing standard WordPress security hardening measures such as 'DISALLOW_FILE_EDIT' and 'DISALLOW_FILE_MODS'.

Impact

Successful exploitation allows for full OS-level command execution with the privileges of the web server service account. This bypasses WordPress application-layer security, potentially leading to complete site compromise, data exfiltration, or deployment of further backdoors on the underlying server environment. The impact is elevated by the ability to circumvent configuration-based protections meant to restrict administrative file system access.

Recommendation

• Update the Backup Migration plugin to a version patched against CVE-2026-7693 immediately.
• Review administrative and user accounts for privilege misuse, specifically monitoring for users assigned the 'do_backups' capability who should not require it.
• Deploy the provided Sigma rule to detect POST requests containing suspicious shell metacharacters directed at the 'restoreBackup' AJAX handler.
• Audit web server access logs for anomalous POST requests to the admin-ajax.php endpoint that contain shell control characters such as semicolons, pipes, or backticks in the 'file' parameter.