The Backup Migration plugin for WordPress suffers from a missing capability verification and no nonce protection on its initializeOfflineAjax function, exposing hard‑coded tokens in the plugin’s JavaScript. Because of this, any unauthenticated user can invoke the AJAX endpoint that triggers the backup upload queue. The consequence is that backups may be transferred to the attacker‑specified cloud storage destination without authorization, and repeated invocations can exhaust server resources. This flaw is a classic Missing Authorization vulnerability (CWE‑862).

The vulnerability affects all releases of the WordPress plugin named inisev:BackupBliss – Backup & Migration with Free Cloud Storage, commonly known as the Backup Migration plugin, up to and including version 2.0.0. WordPress sites that have this plugin installed and have not applied the newer 2.1.0 update are impacted.

The CVSS score of 5.3 indicates medium severity, and the lack of EPSS data makes it unclear how frequently the flaw will be exploited. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending unauthenticated HTTP requests to the plugin’s AJAX endpoint without any proof‑of‑concept documentation, allowing unauthorized backup uploads and potential resource exhaustion. The risk is moderate but remediation should be considered a priority to prevent data leakage and performance degradation.