This WordPress plugin flaw exposed 90,000 websites to hackers

A critical vulnerability in the WordPress Backup Migration Plugin (1.3.7) named CVE-2023-6553 has been discovered by Nex Team researchers during the Wordfence Bug Bounty program. This flaw enables unauthenticated remote code execution, putting over 90,000 websites at risk. Hackers can inject arbitrary PHP code and gain unauthorised access to sensitive data.