CVE-2026-7693 is a command injection vulnerability (CWE-77) in the Backup Migration WordPress plugin affecting all versions up to and including 2.1.5.1. The vulnerability stems from insufficient sanitization of the 'file' POST parameter in the restoreBackup() AJAX handler. The handler uses esc_attr(), which is an HTML context sanitizer that does not remove shell metacharacters, and then concatenates the sanitized input unquoted into a shell command executed via PHP's exec(). This allows authenticated attackers with administrator-level or equivalent plugin capability ('do_backups') to execute arbitrary OS commands as the web-server user, bypassing WordPress hardening constants such as DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS. This issue is an incomplete fix of CVE-2023-7002, where similar command injection was patched only in the 'url' POST parameter path but not in the 'file' parameter path.

An attacker with administrator or equivalent plugin capability can execute arbitrary operating system commands with the privileges of the web-server user. This can lead to full compromise of the web server, data theft, or further attacks. The vulnerability bypasses WordPress hardening constants that normally prevent code execution from the admin UI, increasing the risk of exploitation in environments relying on those protections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted users only and consider disabling the Backup Migration plugin if feasible. Monitor for vendor updates addressing this vulnerability.