CVE-2026-18216 WordPress.org CVE debrief

Who should care

Administrators of multisite WordPress networks using the Backup Migration plugin, security teams monitoring for potential vulnerabilities in WordPress plugins, and operators responsible for maintaining the security of WordPress installations.

Technical summary

The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication. This vulnerability allows an attacker to gain unauthorized access to sensitive areas of the network. The plugin's automatic login mechanism after a post-restore process is flawed, enabling attackers to bypass security measures such as two-factor authentication. Administrators of multisite WordPress networks should verify the plugin version and update to 2.1.7 or later to mitigate this vulnerability.

Defensive priority

Administrators of multisite WordPress networks using the Backup Migration plugin should verify the plugin version and update to 2.1.7 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify the Backup Migration plugin version and update to 2.1.7 or later
• Review multisite network configurations and restrict access to sensitive areas
• Monitor for suspicious activity and implement additional security measures as needed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further investigation is needed to fully understand the impact and scope of this vulnerability. The Backup Migration WordPress plugin before 2.1.7 does not properly restrict a post-restore automatic login mechanism, allowing a user who administers one site of a multisite network to obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication. Evidence is limited to CVE and NVD entries. Defenders should verify plugin version, review multisite configurations, and monitor for suspicious activity.

Official resources