What is the CVSS score of CVE-2026-54839?

CVE-2026-54839 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Trinity Backup are affected by CVE-2026-54839?

The Trinity Backup WordPress plugin (versions 2.0.9 and earlier) contains a data exposure vulnerability allowing unauthenticated remote access to complete backup archives, including databases,…

How to fix or mitigate CVE-2026-54839?

Within 24 hours: Audit all WordPress instances to identify Trinity Backup plugin installations and document affected versions. Within 7 days: Disable the plugin immediately; conduct forensic review of access logs for unauthorized backup retrieval; assess scope of potential data exposure. Within 30 days: Migrate to an alternative backup solution with verified security controls; rotate all potentially exposed credentials; complete backup data security audit.

Trinity Backup CVE-2026-54839

EUVD-2026-39681 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-26 audit@patchstack.com

GHSA-f5x4-57q2-55jv

WordPress Authentication Bypass Information Disclosure Wordpress Plugin

7.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable IDOR exposing backup data gives AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:36 vuln.today

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.

AnalysisAI

Sensitive data exposure in the Trinity Backup WordPress plugin (versions 2.0.9 and earlier) allows remote unauthenticated attackers to retrieve confidential information without any credentials. Because the plugin manages full-site backups, the exposed data may include database dumps, configuration files, and credentials. The flaw was reported by Patchstack and carries a CVSS 7.5; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Trinity Backup plugin for WordPress, a tool advertised for backup, migration, restore, clone, and scheduled-backup operations. The root cause is classed as CWE-639 (Authorization Bypass Through User-Controlled Key, i.e. an IDOR-style flaw), meaning the plugin exposes a resource or endpoint that derives access from a user-controllable identifier without verifying the requester's authorization. In a backup plugin context this typically manifests as an AJAX action, REST route, or predictable backup-archive path that serves stored backup artifacts to any caller. Patchstack additionally tags this as an Authentication Bypass and Information Disclosure issue, consistent with an endpoint that should require an authenticated administrator but does not.

RemediationAI

No vendor-released patch identified at time of analysis; the input does not specify a fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/trinity-backup/vulnerability/wordpress-trinity-backup-backup-migrate-restore-clone-schedule-backups-plugin-2-0-9-sensitive-data-exposure-vulnerability?_s_id=cve) and the WordPress plugin repository for any release above 2.0.9 and upgrade to it once confirmed. Until a fixed version is verified, the safest compensating control is to deactivate and remove the Trinity Backup plugin, which eliminates the exposed endpoint at the cost of losing the plugin's scheduled-backup functionality. If the plugin must remain active, restrict access to the wp-admin/admin-ajax.php and any plugin-specific REST routes via web-server or WAF rules and block external access to backup storage directories (for example deny direct HTTP access to the plugin's backup folder under wp-content), accepting that overly broad rules may interfere with legitimate backup scheduling or restore operations. Additionally, rotate any secrets (database passwords, API keys, salts) that may already have been exposed if logs indicate suspicious access to backup files.