Medium severity · published Apr 7, 2026
CVE-2025-14944
Backup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BB
BackupBliss – Backup & Migration with Free Cloud Storage · inisev
through 2.0.0 · source: vendor
Affected product
BB
BackupBliss – Backup & Migration with Free Cloud Storage
inisev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14944
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/backup-backup/trunk/includes/ajax_offline.php#L112
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/backup-backup/trunk/includes/offline.php#L29
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?old=3386897&old_path=backup-backup%2Ftags%2F2.0.0%2Fincludes%2Foffline.php&new=3449635&new_path=backup-backup%2Ftags%2F2.1.0%2Fincludes%2Foffline.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a2a41a15-0743-48cc-8c92-7cb839fa5847?source=cve
More from BackupBliss – Backup & Migration with Free Cloud Storage
9.8
CVE-2023-6972
Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion
9.8
CVE-2023-6553
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
8.8
CVE-2024-10932
Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
7.5
CVE-2023-6266
Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure
7.2
CVE-2023-7002
Backup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url