CVE-2025-14944

Descripción

The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the -initializeOfflineAjax- function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin-s JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.