UNKNOWN NVD

CVE-2026-18216

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.

References

https://wpscan.com/vulnerability/f12530c5-4069-42c2-9f1c-b00fc62aa387/

Published: 2026-08-15 · Source: NVD · Feed updated: 2026-08-15

This unknown severity vulnerability was published on 2026-08-15 via NVD.

vulnfeed aggregates 11655 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.