dbcve.org
Missing AuthorizationWeakness · CWE-862

CVE-2025-14944

MEDIUM · 5.3 CVSS v3.1 Published 2026-04-07
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
62/100
Remediation priority · Elevated
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
The Backup Migration plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to a missing capability check on the 'initializeOfflineAjax' function and lack of proper nonce verification. The endpoint only validates against hardcoded tokens which are publicly exposed in the plugin's JavaScript. This makes it possible for unauthenticated attackers to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets and resource exhaustion.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Backup Migration WordPress plugin fails to enforce authorization checks on the initializeOfflineAjax function, allowing any unauthenticated user to trigger backup upload queue processing. The endpoint relies on hardcoded tokens exposed in client-side JavaScript instead of proper WordPress nonce verification and capability checks, enabling attackers to cause unauthorized backup transfers to cloud storage and potentially exhaust server resources.

MitigationUpdate the plugin to version 2.0.1 or later which includes proper capability checks and nonce verification. If no patch is available, consider disabling the plugin or implementing web application firewall rules to block unauthorized access to the affected AJAX endpoint.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Verify Backup Migration plugin installation and version
    Navigate to WordPress admin > Plugins > Installed Plugins and locate 'Backup Migration' (may also appear as 'Backup Migration Plugin' or 'backup-backup'). Note the installed version number displayed in the plugin row.
    Affected if The plugin is installed and the displayed version is lower than 2.0.1 (e.g., 2.0.0, 1.x.x, etc.). The absence of a version number may also indicate an older release.
  2. Check plugin files for vulnerable AJAX handler
    Access the server file system and locate the plugin directory under wp-content/plugins/ (commonly named backup-backup or similar). Search for the file containing 'initializeOfflineAjax' function definition, typically in includes/ajax.php or similar. Open the file and locate the function definition.
    Affected if The function 'initializeOfflineAjax' exists in the plugin files and lacks a call to 'check_ajax_referer' or 'wp_verify_nonce' and does not include a current_user_can capability check before processing.
  3. Verify unauthenticated AJAX endpoint accessibility
    Send a POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) with the action parameter set to 'initializeOfflineAjax' or the specific action name used by the plugin. Do not include any authentication cookies or nonce tokens in the request.
    Affected if The AJAX request returns a successful response (HTTP 200) without requiring authentication, indicating the endpoint is publicly accessible.
  4. Inspect client-side JavaScript for hardcoded tokens
    View the page source of any page on the WordPress site (or the plugin settings page). Search for JavaScript files loaded from the plugin. Open these JS files and look for hardcoded token values or secret keys embedded in the code that are sent with AJAX requests.
    Affected if Hardcoded token strings (such as bk_nonce, bk_secret, or similar) are visible in the JavaScript code and are used as the sole authentication mechanism for AJAX requests.

The environment is affected if the Backup Migration plugin is installed with a version lower than 2.0.1 and the initializeOfflineAjax endpoint responds to unauthenticated requests without requiring nonce verification or capability checks.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Update the plugin to version 2.0.1 or later which includes proper capability checks and nonce verification. If no patch is available, consider disabling the plugin or implementing web application firewall rules to block unauthorized access to the affected AJAX endpoint.

Recommended fix Moderate confidence

Latest version available on wordpress.org (likely 2.0.1 or higher, check plugin repository for current stable release)

  1. Check current installed version of the Backup Migration plugin in WordPress admin under Plugins > Installed Plugins
  2. Navigate to Dashboard > Updates or check the plugin page on wordpress.org for the latest version
  3. If not already at the latest version, click 'Update Now' to upgrade the Backup Migration plugin
  4. After update, verify the new version number in the plugins list
  5. Confirm the 'initializeOfflineAjax' function now includes proper capability checks and nonce verification by reviewing plugin changelog or release notes
Caveat Review plugin changelog before updating; minor version updates typically don't introduce breaking changes but always test on staging environment first

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation4.0 h
  • Testing2.0 h
  • Review / QA2.0 h
10.0 hours of engineering $1,780
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,848.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-14944 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-14944 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data