The Backup Migration plugin for WordPress allows an authenticated user with Administrator-level access, or any user granted the plugin’s do_backups capability, to trigger the restoreBackup AJAX handler with a POST parameter named file. The handler concatenates the value of this file parameter, after applying esc_attr(), directly into a shell command executed via exec(). Because esc_attr() does not strip shell metacharacters, an attacker can inject arbitrary shell commands. This enables the attacker to execute code as the web‑server user, effectively achieving full remote code execution. The flaw bypasses WordPress hardening constants such as DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS, making it possible to run code even if file editing is otherwise disabled.

The vulnerability exists in all releases of the Backup Migration plugin up to and including version 2.1.5.1, developed by the inisev vendor. No other products or vendors are cited as affected in the CVE record.

The CVSS score of 7.2 indicates a high severity impact, with an EPSS score of 2% indicating a modest exploitation probability. KEV does not list this vulnerability. Because the attack requires only that the user be logged in with Administrator or do_backups capability, the exposure is limited to administrators, but the impact of exploitation is critical. An attacker can easily incorporate shell metacharacters into the file parameter to run arbitrary commands. The principal attack vector is through an authenticated AJAX POST request to restoreBackup, which most site administrators can access via the WordPress admin UI or programmatically.