CVE-2026-39480— WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability
Quick assessment
Affected
Inisev Backup Migration
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Backup Migration是Inisev公司的一款网站数据备份迁移插件。 Inisev Backup Migration 2.1.1及之前版本存在信息泄露漏洞，该漏洞源于未经验证的敏感数据暴露，可能导致未经身份验证的攻击者获取敏感信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Inisev | Backup Migration | n/a≤ 2.1.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-39480
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WordPress Backup Migration plugin <= 2.1.1 - Sensitive Data Exposure vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Inisev Backup Migration 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Backup Migration是Inisev公司的一款网站数据备份迁移插件。 Inisev Backup Migration 2.1.1及之前版本存在信息泄露漏洞，该漏洞源于未经验证的敏感数据暴露，可能导致未经身份验证的攻击者获取敏感信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Inisev | Backup Migration | n/a ~ 2.1.1 | - |
|
II. Public POCs for CVE-2026-39480
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39480
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-39480 (1)
IV. Related Vulnerabilities
Same product: Backup Migration
-
CVE-2026-18216
Backup Migration < 2.1.7 - Admin+ Privilege Escalation via P -
CVE-2026-7693
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) -
CVE-2025-12394
Backup Migration < 2.0.0 - Unauthenticated Backup Download -
CVE-2024-32686
WordPress Backup Migration plugin <= 1.4.3 - Sensitive Data -
CVE-2023-6271
Backup Migration Staging < 1.3.6 - Sensitive Data Exposure
Same vendor: Inisev
-
CVE-2026-7693
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) -
CVE-2024-31435
WordPress Social Media Share Buttons & Social Sharing Icons -
CVE-2026-53738
Copy & Delete Posts through 1.5.4 Privilege Escalation via c -
CVE-2025-14944
Backup Migration <= 2.0.0 - Missing Authorization to Unauthe -
CVE-2024-10932
Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injec
Same weakness: CWE-201
-
CVE-2026-59809
SiYuan before v3.8.0 Secret Exfiltration via http_request UR -
CVE-2026-63481
Hurl: Cookies in Cookies section leak when redirecting to a -
CVE-2026-75953
Joomla Extension - cmsjunkie.com - Open mail relay in J-Bus -
CVE-2026-73386
WordPress Track Geolocation Of Users Using Contact Form 7 pl -
CVE-2026-73384
WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitiv
V. Comments for CVE-2026-39480
No comments yet