Product
The Backup Migration WordPress plugin is vulnerable to authenticated OS command injection in versions up to 2.1.5.1, allowing attackers with administrative capabilities to execute arbitrary shell commands via the restoreBackup AJAX handler.