CVE-2025-14944: 
WordPress vulnerability analysis and mitigation

CVE-2025-14944 is a Missing Authorization vulnerability in the Backup Migration (BackupBliss) plugin for WordPress, affecting all versions up to and including 2.0.0. The flaw stems from a missing capability check on the initializeOfflineAjax function combined with inadequate nonce verification, allowing unauthenticated attackers to trigger backup upload queue processing. It was published on April 7, 2026, and assigned a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-862 (Missing Authorization): the initializeOfflineAjax AJAX endpoint in offline.php and ajax_offline.php performs no WordPress capability check and no proper nonce validation. Instead, it relies solely on hardcoded tokens that are embedded in and publicly readable from the plugin's JavaScript files, effectively making the authentication bypass trivial for any network-accessible attacker. An unauthenticated attacker can send a crafted HTTP request to the exposed AJAX endpoint using the known hardcoded token to invoke backup upload queue processing (GitHub Advisory, WordPress Trac).

Successful exploitation allows unauthenticated remote attackers to trigger the plugin's backup upload queue, potentially causing backup data to be transferred to attacker-observable or misconfigured cloud storage targets. The primary impacts are availability degradation through resource exhaustion (CPU, bandwidth, storage I/O) and potential unintended data exposure if cloud storage targets are not properly secured. There is no direct confidentiality or integrity impact scored, but repeated triggering could result in service disruption and increased cloud storage costs (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.035–0.051%, placing it in the 16th percentile for exploitation likelihood within 30 days (GitHub Advisory). Despite the low exploitation probability, the attack requires no authentication or user interaction, lowering the barrier for opportunistic abuse.

1. Reconnaissance: Identify WordPress sites running the Backup Migration (BackupBliss) plugin version ≤ 2.0.0 using tools like WPScan, Shodan, or by inspecting publicly accessible plugin metadata at /wp-content/plugins/backup-backup/.
2. Extract hardcoded token: Retrieve the plugin's JavaScript file (e.g., from the plugin's public assets directory) and extract the hardcoded authentication token used by the initializeOfflineAjax endpoint.
3. Craft malicious request: Send an unauthenticated HTTP POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php or equivalent) targeting the initializeOfflineAjax action, supplying the extracted hardcoded token as the authorization parameter.
4. Trigger backup queue: The server processes the request without capability or nonce validation, initiating backup upload queue processing and potentially transferring backup data to configured cloud storage targets or exhausting server resources (GitHub Advisory, WordPress Trac).

• Network: Unusual or repeated unauthenticated POST requests to /wp-admin/admin-ajax.php with the action parameter set to the initializeOfflineAjax handler; unexpected outbound connections from the web server to cloud storage endpoints (e.g., AWS S3, Google Drive, Dropbox).
• Logs: WordPress access logs showing high-frequency unauthenticated AJAX requests to the backup plugin endpoint from a single or rotating IP address; server error logs indicating resource exhaustion or backup process invocations outside of scheduled windows.
• File System: Unexpected backup archive files being created or modified in the plugin's working directory; unusual timestamps on files within /wp-content/plugins/backup-backup/.
• Process: Elevated CPU or disk I/O usage on the web server correlating with unauthenticated AJAX requests; unexpected cloud storage upload processes spawned by the web server user account.

Update the Backup Migration plugin to version 2.1.0 or later, which introduces proper capability checks and nonce verification in the initializeOfflineAjax function (WordPress Trac). If immediate patching is not feasible, disable the Backup Migration plugin until the update can be applied, or use a Web Application Firewall (WAF) to block unauthenticated requests to the vulnerable AJAX endpoint. Restricting access to /wp-admin/admin-ajax.php for unauthenticated users at the server or firewall level can also reduce exposure (Wordfence).

Wordfence disclosed the vulnerability and assigned it a Medium severity rating, noting the missing capability check and hardcoded token exposure as the primary concerns (Wordfence). Sucuri included it in their April 2026 vulnerability patch roundup, recommending prompt updates for affected WordPress site administrators (Sucuri Blog). Community reaction has been limited given the moderate severity and lack of active exploitation.