Snapshotify CVE-2026-42413

The site must be running the Snapshotify - All-in-One Backup & Restore & Migrate WordPress plugin at version 1.3.2 or earlier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation is remote and unauthenticated with no user interaction against the plugin's default behavior. The primary limiting factor is deployment: only sites with this specific plugin installed and activated are affected, which constrains the attack surface to a relatively small population of WordPress installations. The precise feature or request that triggers the disclosure is not detailed in the available data and should be confirmed from the Patchstack advisory.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely exploitable, unauthenticated flaw with low attack complexity and no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with CWE-201 (sensitive information exposure in transmitted data). This signal set points to an information-disclosure issue rather than code execution or takeover. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided, so exploitation likelihood and automatability cannot be quantified from the input - the only exploitation-relevant evidence is the Patchstack advisory itself, which classifies it as a disclosure vulnerability. The practical priority is moderate: the unauthenticated network vector makes it opportunistically scannable, but the limited deployment footprint of this specific WordPress plugin and the absence of any exploitation signal (no KEV, no POC) suggest this is a real-but-not-urgent issue rather than a high-severity emergency. Note the gap: a 7.5 'High' rating here is driven entirely by confidentiality loss of unspecified sensitive data - the exact data exposed is not described, so impact severity should be verified against the vendor advisory.

A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running a vulnerable Snapshotify plugin (<= 1.3.2) and retrieves sensitive data the plugin improperly includes in its responses, such as backup contents, configuration, or credentials. The AV:N/AC:L/PR:N/UI:N vector means no login, no user interaction, and little complexity are required. No public exploit code is identified at time of analysis, so exploitation would require reconstructing the request from the vulnerability details.