What is the CVSS score of CVE-2026-57757?

CVE-2026-57757 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of pCloud WP Backup are affected by CVE-2026-57757?

The pCloud WP Backup WordPress plugin (versions 2.0.2 and earlier) contains a cross-site request forgery vulnerability that enables unauthenticated attackers to trick administrators into executing…

How to fix or mitigate CVE-2026-57757?

Within 24 hours: Disable pCloud WP Backup plugin (v2.0.2 and earlier) across all WordPress installations; migrate to an alternative backup solution with current security patches. Within 7 days: Review backup activity logs for unauthorized modifications; audit administrator accounts and sessions for signs of compromise. Within 30 days: Monitor vendor security advisory for patch release; implement automated update deployment for immediate patching upon vendor release.

pCloud WP Backup CVE-2026-57757

EUVD-2026-41313 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-02 Patchstack

GHSA-v7j3-6p47-qxc7

WordPress CSRF Wordpress Plugin Pcloud Wp Backup

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Remote CSRF needs no attacker privileges (PR:N) but requires an authenticated admin to click (UI:R); forged action exposes sensitive data (C:H) with limited state change (I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:22 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions.

AnalysisAI

Cross-Site Request Forgery in the pCloud WP Backup WordPress plugin (versions 2.0.2 and earlier) allows a remote unauthenticated attacker to trick a logged-in administrator into submitting forged requests, leading to high-confidentiality impact and limited integrity impact on the WordPress site. The CVSS 3.1 base score is 7.1 (AV:N/AC:L/PR:N/UI:R), reflecting network exploitation with no attacker privileges but required victim interaction. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is pCloud WP Backup, a WordPress plugin (vendor ploudapp per CPE cpe:2.3:a:ploudapp:pcloud_wp_backup) that integrates the pCloud cloud storage service to back up WordPress sites. The root cause is CWE-352 (Cross-Site Request Forgery): one or more state-changing plugin actions accept requests without validating a WordPress anti-CSRF nonce or equivalent token, so the plugin cannot distinguish a legitimate admin-initiated request from one forged by an attacker's page. Because WordPress relies on nonce verification (check_admin_referer / wp_verify_nonce) to bind privileged actions to an authenticated session, a missing or improper nonce check on a backup/configuration endpoint lets attacker-controlled HTML/JS drive that action using the victim's authenticated cookies.

RemediationAI

No vendor-released patch version is identified in the provided data, so the primary recommendation is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/pcloud-wp-backup/vulnerability/wordpress-pcloud-wp-backup-plugin-2-0-2-cross-site-request-forgery-csrf-vulnerability) and upgrade to a fixed release once published; if a version above 2.0.2 is available in the WordPress plugin repository, update to it immediately. Until a patch is confirmed, deactivate the pCloud WP Backup plugin if backup functionality is not actively required (trade-off: scheduled pCloud backups stop). As compensating controls, restrict wp-admin access to trusted IP ranges or place it behind additional authentication to reduce the chance an admin session is abused, and deploy a WAF or WordPress security plugin with CSRF/referrer protections on plugin admin endpoints (trade-off: possible false positives on legitimate admin actions). Administrators should also avoid clicking untrusted links while logged into WordPress, since victim interaction is required.