BACKUP MIGRATION · CVE-2026-127050 · Package
NO FIX YET · SEE WHAT TO DO
Backup Migration for WordPress before 2.1.8 has a path traversal flaw in its PclZip restore fallback, used on servers without the PHP zip extension. A malicious backup archive with '..' entry names can write a PHP file outside the extraction folder into the web-servable tree, leading to remote code execution.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running the Backup Migration WordPress plugin before 2.1.8, particularly where the PHP zip extension is not installed so the PclZip restore fallback runs. Exploitation requires an administrator to restore a malicious backup archive, so sites that never restore untrusted backups are at lower risk. Sites on hosts with the zip extension may not use the vulnerable code path.
Not affected if no-untrusted-restores, version-2.1.8-or-later, zip-extension-installed
Who cares php, self-hosted, wordpress
2.1.8.php -m | grep -i zip to see whether the PHP zip extension is missing, which activates the PclZip fallback.2.1.8 or laterBackup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing ".." sequences, which PclZip's extract() processes without the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.