CVE-2023-6553

What it actually does

This is an unauthenticated remote code execution vulnerability in the Backup Migration plugin for WordPress, affecting versions up to and including 1.3.7. The vulnerable /includes/backup-heart.php endpoint allows attacker-controlled values to influence a PHP include operation, enabling arbitrary PHP code execution in the context of the web server process. Successful exploitation can provide the attacker with the same filesystem, database, and network access available to the WordPress/PHP runtime.

Why it matters to the business

An attacker can take over a vulnerable WordPress site without logging in, leading to website defacement, malware or web shell installation, theft of database credentials and user data, spam/SEO abuse, service disruption, and possible lateral movement from the web server. The vulnerability is weaponized, has a very high EPSS score, and has been public for a long time, so internet-facing sites running the affected plugin should be treated as high-risk even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker scans the internet for WordPress sites exposing the Backup Migration plugin path, then sends a crafted unauthenticated HTTP request to /wp-content/plugins/backup-backup/includes/backup-heart.php. By manipulating include-related input, the attacker causes PHP to load attacker-controlled content or a local file that can be turned into executable PHP. Once code execution is achieved, the attacker commonly runs reconnaissance commands, reads wp-config.php for database credentials and salts, drops a persistent PHP web shell under a writable WordPress directory, creates or modifies administrator accounts, injects malicious JavaScript or spam content, and uses the compromised server for further attacks or monetization.

How to fix it

Upgrade the Backup Migration plugin to a version newer than 1.3.7, preferably the latest available release from the WordPress plugin repository or vendor. If immediate upgrade is not possible, disable and remove the plugin until it can be safely updated. Block direct external access to /wp-content/plugins/backup-backup/includes/backup-heart.php using a WAF, reverse proxy, or web server rule as a temporary mitigation. Restrict PHP execution in writable directories such as wp-content/uploads, review filesystem permissions, and ensure the web server user cannot write to plugin and theme code directories unless required for controlled updates. Rotate WordPress administrator passwords, database passwords, salts, and any credentials stored in wp-config.php if exploitation is suspected. The Linux kernel package fixed-version entries supplied with the input do not remediate this WordPress plugin RCE and should not be treated as the primary fix for this vulnerability.

How to confirm the fix worked

Confirm the installed Backup Migration plugin version is greater than 1.3.7 using the WordPress admin interface, WP-CLI, filesystem metadata, or plugin inventory tooling. With WP-CLI, verify with a command such as wp plugin list and check the backup-backup plugin version and status. Confirm that unauthenticated requests to /wp-content/plugins/backup-backup/includes/backup-heart.php are blocked, return a non-exploitable response, or are no longer present after plugin removal. Review web server configuration to ensure direct PHP execution is denied in writable upload locations. After patching, run an authenticated WordPress vulnerability scan and compare plugin file checksums against a known-good installation. If compromise is suspected, validate that no unexpected PHP files, modified plugin/theme files, unauthorized admin users, scheduled tasks, or suspicious database changes remain.

Typical attack path

1. Identify WordPress sites exposing the Backup Migration plugin, often by probing /wp-content/plugins/backup-backup/ paths.
2. Confirm the vulnerable plugin is present and likely at version 1.3.7 or earlier.
3. Send a crafted unauthenticated request to /wp-content/plugins/backup-backup/includes/backup-heart.php with attacker-controlled include-related values.
4. Trigger PHP code execution under the web server user account.
5. Read WordPress configuration files and database credentials.
6. Write a PHP web shell or loader into a writable WordPress directory such as uploads, themes, or plugins.
7. Establish persistence through new admin users, modified plugin/theme files, scheduled tasks, or reinfection scripts.
8. Use the compromised site for data theft, malware hosting, redirects, spam, botnet activity, or further internal reconnaissance.

How to detect it

Review HTTP access logs, WAF logs, reverse proxy logs, PHP-FPM logs, web server error logs, endpoint telemetry, and WordPress audit logs. Search for unauthenticated requests to /wp-content/plugins/backup-backup/includes/backup-heart.php, especially POST requests, requests with include-wrapper strings such as php://, data://, phar://, zip://, or expect://, path traversal sequences, references to wp-config.php, or unexpected 200 responses. Correlate any hits with file creation or modification events under wp-content/uploads, wp-content/plugins, wp-content/themes, cache directories, backup directories, and the web root. Look for PHP web shells containing command execution functions, base64 decoding, eval/assert patterns, or request parameters such as cmd. Review process telemetry for the web server or php-fpm spawning shells, interpreters, download tools, or network utilities. Check for newly created WordPress administrator accounts, modified plugin/theme files, altered .htaccess files, suspicious scheduled tasks, and unexpected outbound connections from the web server around the time of suspicious requests.

• /wp-content/plugins/backup-backup/includes/backup-heart.php
• POST /wp-content/plugins/backup-backup/includes/backup-heart.php
• GET /wp-content/plugins/backup-backup/includes/backup-heart.php
• /wp-content/plugins/backup-backup/readme.txt
• content-dir=
• Content-Dir:
• php://filter
• php://input
• data://
• expect://
• phar://
• zip://
• ../wp-config.php
• /wp-config.php
• eval(base64_decode(
• assert($_POST
• system($_
• shell_exec($_
• passthru($_
• proc_open($_
• popen($_
• cmd=
• /wp-content/uploads/
• /wp-content/uploads/*.php
• .htaccess
• AddType application/x-httpd-php
• SetHandler application/x-httpd-php

What your security team should do

• Immediately inventory internet-facing WordPress sites for the Backup Migration plugin and prioritize any version 1.3.7 or earlier.
• Upgrade the plugin to the latest version or remove it if not business-critical.
• Deploy WAF or web server rules blocking unauthenticated access to /wp-content/plugins/backup-backup/includes/backup-heart.php while remediation is underway.
• Assume vulnerable internet-facing instances may have been probed or exploited because exploitation is weaponized and EPSS is very high.
• Hunt web access logs for requests to the vulnerable endpoint, especially POST requests, unusual include-wrapper strings, traversal sequences, or successful 200 responses.
• Inspect WordPress filesystems for new or recently modified PHP files in uploads, themes, plugins, cache, and backup directories.
• Review WordPress administrator accounts, plugin/theme modifications, cron jobs, and database options for unauthorized persistence.
• Rotate WordPress, database, hosting control panel, and API credentials if exploitation cannot be ruled out.
• Rebuild from known-good backups if web shells, modified core/plugin files, or persistent reinfection mechanisms are found.
• Add continuous monitoring for vulnerable WordPress plugins and enforce rapid update SLAs for unauthenticated RCE vulnerabilities.