CVE-2023-6553: Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
HoneyLabs honeypots recorded 2 probes matching CVE-2023-6553 from 2 distinct source IP addresses in the last 7 days, of which 1 on interactive sensors. Severity is rated critical.
One source probed for CVE-2023-6553 on the interactive sensors. It did not send the exploit payload.
What the sensors show
Probes arrived on 2 of the 7 days in this window. The busiest day was 2026-11-07, with 1. One address, 142.91.99.247, sent 50% of them. The largest source network was AS203861 (Miteflux Technologies Ltd), with 50% of the probes from 1 address. Over the last 90 days the sensors recorded 4 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i9013h1_c6771aded2ed_0605f505085f.
Request paths that identify it
- /wp-content/plugins/backup-backup/includes/backup-heart.php
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 142.91.99.247 | 1 | LEASEWEB SINGAPORE PTE. LTD. | Singapore |
| 31.59.160.24 | 1 | Miteflux Technologies Ltd | Sweden |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS203861 | Miteflux Technologies Ltd | 1 | 1 |
| AS59253 | LEASEWEB SINGAPORE PTE. LTD. | 1 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| Sweden | 1 |
| Singapore | 1 |
Captured requests
- /wp-content/plugins/backup-backup/includes/backup-heart.php
Requests the interactive sensors answered
- POST /wp-content/plugins/backup-backup/includes/backup-heart.php
HTTP client fingerprints
- b11cuq040_00050810_a31e7c35
- b11cuq081_00050817_cb8d62e5_x17c5
CVE report
Open a specific CVE from the CVE tracker.