# CVE-2023-6553: Migrate - RCE

> Live exploitation tracking for CVE-2023-6553 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-6553

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Migrate Backup Migration
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** cms, wordpress

## Description

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated attackers to easily execute code on the server.

## CrowdSec analysis

[CVE-2023-6553](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-6553) is a critical vulnerability in the Backup Migration plugin for WordPress that allows unauthenticated remote code execution via a component responsible for managing backup operations.

CrowdSec has been tracking this vulnerability and its exploits since 8th of January 2024.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-6553 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Exploitation attempts would typically involve requests directed at paths including `/includes/backup-heart.php`.

## Timeline

- 2023-12-15: CVE Published. CVE-2023-6553 is published to NVD.
- 2024-01-08: Rule Released. CrowdSec releases a rule to detect CVE-2023-6553 exploitation attempts against the CrowdSec Network.
- 2024-12-08: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-6553 for the first time.

## References

- https://www.synacktiv.com/en/publications/php-filters-chain-what-is-it-and-how-to-use-it
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6553.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-6553) follows observed exploitation activity for CVE-2023-6553. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.