The Backup Migration WordPress plugin before version 2.1.7 contains an improper authentication vulnerability (CWE-287) in its post-restore automatic login feature. This flaw permits a user who has administrative privileges on one site within a multisite WordPress network to obtain a persistent authenticated session as an administrator on another site in the same network. This escalation occurs without requiring credentials and bypasses two-factor authentication protections, potentially compromising the security boundaries between sites in the multisite environment.

An attacker with administrative rights on one site in a multisite WordPress network can leverage this vulnerability to gain unauthorized administrator access to other sites in the network. This unauthorized access bypasses two-factor authentication and results in a high impact on confidentiality and integrity of the affected sites. Availability is not affected. The CVSS score of 6.5 reflects a medium severity with network attack vector, low attack complexity, and required privileges but no user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting multisite administrative privileges and monitor for unusual cross-site administrative activity. Avoid using the vulnerable plugin versions and upgrade to version 2.1.7 or later once a patch is confirmed.