SafeSnap CVE-2026-41559

The input description and CWE-201 indicate the plugin inserts sensitive information into data it sends to clients, but the advisory does NOT name the specific endpoint, feature, or configuration that triggers the exposure, so the exact precondition cannot be confirmed from available data. Based on the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network access to a WordPress site with SafeSnap - Verified WordPress Backup & Restore version 2.1.2 or earlier installed and active; no authentication, no user interaction, and no non-default configuration are indicated. The primary limiting factor is deployment: only sites running this specific, relatively uncommon plugin at a vulnerable version are affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact and no integrity or availability effect - a classic information-disclosure signature consistent with CWE-201 (sensitive information inserted into sent data). The real-world priority signals are thin: there is no EPSS probability supplied, the CVE is not on the CISA KEV list, and no public proof-of-concept is referenced, so this is a high-CVSS issue without evidence of active or imminent exploitation. The single source is Patchstack, a credible WordPress-focused research outfit, which lends confidence to the technical classification but the Patchstack advisory is the only reference and no independent vendor advisory is linked. Net: treat as a moderate, patch-on-normal-cycle item rather than an emergency - the unauthenticated network vector justifies attention, but absence of EPSS, KEV, and POC signals, combined with the niche plugin footprint, argues against widespread opportunistic exploitation. Note also that the description does not specify WHAT sensitive data is exposed or under what conditions, which limits precise risk scoring - verify specifics with the Patchstack database entry.

A remote, unauthenticated attacker sends crafted requests to a WordPress site running the SafeSnap backup plugin (version 2.1.2 or earlier) and retrieves sensitive data the plugin inadvertently includes in its responses - plausibly backup contents, paths, or configuration metadata. No special privileges or user interaction are required (PR:N/UI:N). No public exploit code is identified at time of analysis, so exploitation would currently require independent research.