Wordpress Alert: Exposed migration archives

What it looks like

A migration package remains publicly downloadable after a move.

Why it matters

It may contain database data and configuration secrets.

What to check

Remove old archives and restrict backup storage.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress backup guidance, WordPress hardening guide.