WXD Backup Lite CVE-2026-41560

Requires that the target WordPress site has the WXD Backup Lite plugin installed and active at version 1.0.2 or earlier; the vulnerable plugin functionality (a backup-related endpoint/action lacking an authorization check per CWE-862) must be reachable over the network. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are indicated - exploitation works against a default installation of the affected plugin. The primary limiting factor is deployment: the attack is only possible where this specific, low-footprint plugin is present, which sharply narrows the realistic target population. Impact is confined to confidentiality (C:H, I:N, A:N) - unauthorized read/access to backup data rather than modification or denial of service.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) describes a cleanly remote, low-complexity, unauthenticated flaw with no user interaction and high confidentiality impact only - consistent with a backup plugin exposing archive contents to anyone. No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT on CISA KEV, and no public exploit code (POC) was indicated in the supplied data, so this is 'no public exploit identified at time of analysis.' Signals do not conflict: a confidentiality-only broken-access-control bug in a WordPress plugin is a real but bounded priority - the CVSS is driven by C:H (potential exposure of backup archives containing site data, credentials, or database dumps), while I:N/A:N means no direct tampering or disruption. Given the very limited deployment footprint of this specific plugin, the practical risk is moderate and most relevant to sites that actually run WXD Backup Lite; mass exploitation is less likely than opportunistic scanning of known-vulnerable installs. No EPSS/KEV data means threat-timing is unconfirmed - treat as a patch-soon item, not an emergency, unless the plugin is confirmed present.

An unauthenticated attacker identifies a WordPress site running WXD Backup Lite 1.0.2 or earlier and sends a direct request to a plugin endpoint that fails to enforce an authorization check (CWE-862). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, the request requires no login, no user interaction, and little complexity, potentially letting the attacker read or download backup data they should not be able to access. No public exploit code was identified in the provided data, so exploitation would currently require independent research of the endpoint.