{"id":"CVE-2026-97197","published":"2026-09-30T13:17:34.877","lastModified":"2026-09-30T14:18:14.280","description":"Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-migration-duplicator/vulnerability/wordpress-wordpress-backup-migration-plugin-1-6-0-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A WordPress plugin with unauthenticated broken access control allows attackers to bypass authentication and access backup files without any credentials. This vulnerability affects versions up to 1.6.0 and can lead to sensitive data exposure.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability allows full access to backup files from any unauthenticated user.","blast_radius":"The impact could be significant as attackers can access complete WordPress backups containing database credentials, user information, and potentially other sensitive files.","remediation":"Upgrade to version 1.6.1 or later which includes the access control fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["backup","access-control","wordpress"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:58.887Z"}}