CVE-2026-7693 is an OS Command Injection vulnerability in the inisev Backup Migration WordPress plugin. The issue arises because the restoreBackup() AJAX handler insufficiently sanitizes the 'file' POST parameter, applying only esc_attr(), which is an HTML context sanitizer and does not remove shell metacharacters. The sanitized input is then concatenated unquoted into a shell command executed via PHP's exec() function. This allows authenticated users with Administrator or 'do_backups' capability to execute arbitrary commands as the web-server user, bypassing WordPress hardening constants such as DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS. This vulnerability is an incomplete fix of CVE-2023-7002, which addressed a similar issue in a different code path but did not apply the same mitigations to the backupName variable used here.

An attacker with Administrator-level or equivalent plugin permissions can execute arbitrary operating system commands on the web server with the privileges of the web-server user. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability bypasses WordPress hardening constants designed to prevent code execution from the admin interface, increasing the risk of exploitation in environments relying on those protections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been publicly disclosed at this time. Until a patch is available, restrict plugin access to trusted administrators only and monitor for updates from the vendor. Avoid granting the 'do_backups' capability to untrusted users. Follow vendor advisories closely for any forthcoming fixes or official mitigations.