Backupbliss Backup Migration With Free Cloud Storage EUVD-2025-209272

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates a low-complexity, unauthenticated remote network attack with no user interaction required, resulting in availability impact (denial of service via resource exhaustion). However, the lack of confidentiality or integrity impact, combined with the 5.3 base score, reflects the medium-severity classification. The real-world risk is elevated by the authentication bypass nature: hardcoded, publicly exposed tokens eliminate any practical security barrier. This is not a theoretical or low-probability issue-any attacker with network access can exploit it. No EPSS score, KEV status, or public exploit code was provided; however, the straightforward nature of the vulnerability (sending crafted AJAX requests with known tokens) and the clear privilege escalation pathway (unauthenticated to backup initiator) suggest this is actionable. Organizations running WordPress with this plugin should prioritize patching to mitigate resource exhaustion and unexpected cloud storage charges.

An attacker discovers the hardcoded token values embedded in the plugin's JavaScript files by inspecting publicly accessible source code. Using a simple HTTP request library, the attacker crafts POST requests to the vulnerable AJAX endpoint with the known token and triggers the backup upload queue on a target WordPress site. The plugin initiates unauthorized backup transfers to the site owner's cloud storage, consuming bandwidth, storage quota, and potentially incurring unexpected costs. If the site runs multiple backups daily or the attacker triggers repeated requests, resource exhaustion degrades server performance and availability.