Web Plura Backup CVE-2026-42630

Requires only that the target WordPress site has the Web Plura Backup & Restore Manager plugin (version 0.2.25 or earlier) installed and active; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation is remote and unauthenticated with no user interaction against a default install. The input does not specify a particular feature, setting, or configuration mode as a precondition, so the exposed data path appears reachable without special configuration. The principal limiting factor is product scope: only sites running this specific, low-footprint plugin are affected, and impact is confined to confidentiality (C:H, I:N, A:N) - no data modification or availability loss. No fixed version was provided in the input, so upgrade guidance should be verified against the vendor/Patchstack advisory.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) describes a remotely reachable, low-complexity, unauthenticated confidentiality-only exposure, which is internally consistent with the CWE-201 (sensitive information in sent data) classification and the 'Unauthenticated Sensitive Data Exposure' description. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The only intelligence source is a single Patchstack advisory; there is no independent corroboration, no CVSS temporal/exploit-maturity data, and no confirmed in-the-wild activity. Net assessment: the raw 7.5 reflects easy unauthenticated remote access to sensitive data, but real-world priority is tempered by the apparent niche footprint of this specific WordPress plugin and the absence of any exploitation or POC signal - treat as a genuine confidentiality risk for the (likely small) population running this plugin rather than a broad emergency. No direct contradictions exist between the CVSS vector and description; the main gap is the lack of EPSS/KEV/POC telemetry to gauge likelihood.

A remote, unauthenticated attacker sends a request to a WordPress site running Web Plura Backup & Restore Manager <= 0.2.25 and retrieves sensitive data (such as backup contents or configuration/credential material) that the plugin improperly exposes. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no login, user interaction, or special timing is required. No public exploit code is identified at time of analysis, so exploitation would require an attacker to independently identify the exposed endpoint or data path.