The Backup Migration plugin for WordPress, BackupBliss, suffers from a missing authorization vulnerability (CWE-862) in all versions up to 2.0.0. Specifically, the 'initializeOfflineAjax' function does not perform capability checks or proper nonce verification. Instead, it validates requests using hardcoded tokens embedded in the plugin's JavaScript, which are publicly accessible. This flaw enables unauthenticated attackers to invoke the backup upload queue processing endpoint, potentially causing unintended backup operations and resource exhaustion. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. There is no vendor advisory or patch available at this time.

An unauthenticated attacker can exploit this vulnerability to trigger the backup upload queue processing, potentially causing unexpected backup transfers to configured cloud storage targets. This may lead to resource exhaustion on the affected system. There is no indication of confidentiality or integrity impact, only availability impact rated as low to medium. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected plugin functionality to prevent unauthorized triggering of backup processes. Monitor plugin updates from the vendor for a security patch addressing this missing authorization issue.