EUVD-2026-45132
GHSA-6qxr-g8rc-cpg3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network AJAX endpoint exploitable with subscriber-level credentials (PR:L); confidentiality is high due to wp-config.php and salt exposure; no integrity or availability impact applies.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.
AnalysisAI
Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected wp2pcl_ajax_process_request_inner AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible tmp/ directory at a predictable URL, exposing wp-config.php database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.
Technical ContextAI
The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected AJAX handler wp2pcl_ajax_process_request_inner, visible in the WordPress plugin repository source at pcloud-wp-backup.php (lines 210, 217, 572, 1635) and Pcloud/Classes/class-wp2pcloudfilebackup.php (line 111), fails to enforce adequate authorization checks before executing backup generation logic. WordPress's subscriber role is the lowest authenticated user role, obtainable through self-registration on sites with open registration enabled. The backup archive is written to the plugin's tmp/ subdirectory, which resides within the publicly web-served WordPress directory tree and lacks any access restriction mechanism (no .htaccess deny rule, no index.php empty guard). The archive filename is predictable rather than randomized, enabling targeted unauthenticated retrieval. The contents of wp-config.php - the single most sensitive file in any WordPress installation - include the MySQL database hostname, name, username, and password, as well as all WordPress authentication keys and salts used to sign and verify session cookies. CPE cpe:2.3:a:ploudapp:pcloud_wp_backup:*:*:*:*:*:*:*:* identifies the affected product across all versions through 2.0.3.
RemediationAI
Update the pCloud WP Backup plugin to the version incorporating WordPress plugin repository changeset 3597399; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0b301c6e-a3c5-4435-9bc9-fab18085fe2d should be consulted for the confirmed patched release version once published. If immediate update is not possible, deactivate or uninstall the plugin as the most effective compensating control - this eliminates all attack surface at the cost of losing plugin-provided backup functionality entirely. As a partial mitigation that does not remove the trigger risk, add an .htaccess rule to the plugin's tmp/ directory containing deny from all to block unauthenticated archive retrieval; note this addresses only Phase 2 of the attack and an attacker with subscriber access could still repeatedly trigger backup generation, consuming server resources and leaving archives unretrievable but still generated. Additionally, disable open WordPress user registration (Settings > General > Membership) to raise the entry bar for Phase 1, recognizing that this does not protect sites where subscriber accounts already exist or have been compromised.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today