EUVD-2026-93048
GHSA-h5r8-4r93-8w49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
ExploitSend crafted unauthenticated HTTP request
-
ExecutionPlugin returns sensitive data
-
ImpactHarvest exposed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | No special conditions beyond having the plugin installed - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation requiring no user interaction against installations of Museder RestoreOne WordPress plugin version 2.7.276 or earlier. The primary limiting factor is deployment scope: only WordPress sites that have this specific, niche plugin installed and active are affected, and only versions <= 2.7.276. No particular non-default configuration is named in the description, so default installs of the vulnerable version are presumed exploitable; confirm the specific vulnerable endpoint and whether any plugin feature must be enabled via the Patchstack advisory. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with high confidentiality impact (C:H) and no integrity or availability effect, scored 7.5 (High) - consistent with CWE-201 (exposure of sensitive information through sent data). On paper this is easy to exploit, but the real-world priority is tempered by several factors. No EPSS score, no CISA KEV listing, and no public exploit (POC) are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The affected product, the 'Museder RestoreOne' WordPress plugin (vendor adrian_lin), is an obscure, low-footprint plugin rather than a widely deployed platform, which sharply limits mass-exploitation potential compared to a similarly-scored flaw in core infrastructure. Net assessment: a technically clean unauthenticated info-disclosure bug that warrants prompt patching on affected sites, but it is a high-CVSS / low-current-real-risk issue in the absence of exploitation signals and given the narrow deployment base. Note: the exact category of 'sensitive data' exposed is not specified in the description - verify with the Patchstack advisory to gauge concrete impact. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running Museder RestoreOne <= 2.7.276 and retrieves sensitive data the plugin discloses without access controls. No authentication or user interaction is required (PR:N/UI:N, AC:L), but no public exploit code is identified at time of analysis, so exploitation would require independent development against the specific vulnerable endpoint. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated sensitive data exposure in the Museder RestoreOne WordPress plugin (versions up to 2.7.276) allows remote attackers to access confidential information without authentication. With a CVSS score of 7.5 (High), the flaw requires no user interaction and has high confidentiality impact (C:H) but no integrity or availability effect. No public exploit code or active exploitation has been identified at time of analysis, and the risk is confined to WordPress sites with this specific plugin installed.
RemediationAI
No vendor-released patch has been identified at time of analysis. Administrators should check the Patchstack advisory for updates and contact the vendor for a fix. As an immediate mitigation, consider disabling or uninstalling the Museder RestoreOne plugin if it is not essential; this may remove backup and restore functionality. If the plugin must remain active, restrict access to its endpoints (e.g., via a web application firewall or by requiring authentication at the web server level) to prevent unauthenticated requests. However, such restrictions could break legitimate plugin functionality for authorized users. Monitor the vendor's site and WordPress plugin repository for a patched version and apply it promptly once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified as CWE-201, Exposure of Sensitive Information Through Sent Data, meaning the plugin transmits sensitive data in a response to an unauthenticated request. The affected component is the Museder RestoreOne WordPress plugin, identified by vendor Adrian Lin and product museder_restoreone (CPE: cpe:2.3:a:adrian_lin:museder_restoreone:*:*:*:*:*:*:*:*). As a backup and restore utility, the plugin may expose database backups, configuration files, or other sensitive information via an unprotected AJAX action, REST API endpoint, or direct file access. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms the attack is network-reachable, low-complexity, and requires no authentication or user interaction. The root cause is likely missing authentication or authorization checks on a function that returns sensitive data to the requester.
Know when Museder Restoreone gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable disclosure with no user interaction (AV:N/AC:L/PR:N/UI:N); high confidentiality impact only, with no integrity or availability effect (C:H/I:N/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
Executive ViewAI
The Museder RestoreOne WordPress plugin, deployed on customer-facing websites in versions up to 2.7.276, contains a high-severity flaw that lets remote parties retrieve confidential information from affected sites with no user interaction and no integrity or availability impact. Any business unit running this plugin on an internet-exposed WordPress property - marketing, e-commerce, or partner portals - could have sensitive data disclosed without detection, and because no public exploit code or active exploitation has been identified at time of analysis, leadership has a window to remediate proactively. No vendor-released patch has been identified, so risk must be reduced through removal or containment of the plugin rather than routine patching.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the Museder RestoreOne plugin (all versions up to and including 2.7.276); where it must remain, block direct external access to plugin files and endpoints via WAF or web server rules, and restrict access by IP allowlist; deploy virtual patching if your WAF vendor provides a signature for CVE-2026-41561; enable and monitor logging for requests to plugin paths; and review logs for prior exposure of confidential data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB