CVE-2023-6553

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

9.8 CriticalPublic exploit

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

97.8%Up 94.8 points since Dec 16, 2023

What each source reports

CVE List Score used 9.8

Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

Record: CVE-2023-6553
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2023-58782 9.8

Record: EUVD-2023-58782
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-2rcj-3wpj-27f2 9.8

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions...

Record: GHSA-2rcj-3wpj-27f2
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 9.8

Record: CVE-2023-6553
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WordPress Backup Migration 1.3.7 - Remote Command Execution	2026-03-03
Metasploit	WordPress Backup Migration Plugin PHP Filter Chain RCE	2023-12-11
Nuclei	Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
PoC in GitHub	0x00phantom-hat/CVE-2023-6553-RCE-Exploit	2026-04-10
PoC in GitHub	Chocapikk/CVE-2023-6553	2023-12-13
PoC in GitHub	Dungsocool/CVE-2023-6553	2026-08-05
PoC in GitHub	Harshit-Mashru/CVE-2023-6553	2024-11-07
PoC in GitHub	cc3305/CVE-2023-6553	2024-06-29
PoC in GitHub	joaoaugustom/WordPress_Backup_Migration-RCE_Unauthenticated	2026-05-31
PoC in GitHub	motikan2010/CVE-2023-6553-PoC	2023-12-27

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-6553 is a critical vulnerability (CVSS 9.8) in Backupbliss Backup Migration, published December 15, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.8%, the 99th percentile. No source names a fixed version.