Critical RCE Bug in WordPress Backup Plugin Exposes 50K Sites

A critical vulnerability in the Backup Migration plugin for WordPress has exposed over 50,000 websites to remote code execution (RCE) attacks. The security flaw, tracked as CVE-2023-6553, allows unauthenticated attackers to take control of targeted websites by injecting malicious PHP code. The vulnerability affects all versions of the plugin up to and including Backup Migration 1.3.6. The developers have released a patch, but nearly 50,000 vulnerable WordPress sites have yet to be secured. WordPress administrators are also being targeted by a phishing campaign using fake security advisories.