CVE-2026-120530

Name of the Vulnerable Software and Affected Versions WebToffee WP Backup and Migration versions prior to 1.6.2

Description An issue exists where authenticated users with subscriber-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the description parameter and a lack of preparation in the SQL query. An attacker can append additional SQL queries to extract sensitive information from the database. Exploitation requires an administrator to perform the plugin's standard local database export and restore operation on the site, as the attacker cannot trigger the process independently.

Recommendations Update to a version newer than 1.6.1. Restrict the use of the description parameter for users with low-level privileges until the update is applied.