EUVD-2026-36864
GHSA-jvmc-v9mp-529c
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Subscriber role implies authenticated low-privilege access (PR:L); CWE-201 mandates confidentiality impact (C:L); no integrity or availability impact supported by description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.
AnalysisAI
Sensitive data exposure in the XCloner backup and restore WordPress plugin (versions up to and including 4.8.6) permits unauthorized access to subscriber-level sensitive information via a network-accessible attack path. The vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or transmitted content accessible without sufficient authorization controls. Discovered and reported by Patchstack, this flaw carries a CVSS 3.1 base score of 6.5 with no public exploit or CISA KEV listing identified at time of analysis.
Technical ContextAI
XCloner is a WordPress backup and restore plugin developed by Watchful (CPE: cpe:2.3:a:watchful:xcloner:*:*:*:*:*:*:*:*). CWE-201 describes a root cause where an application inserts sensitive data - such as credentials, backup paths, configuration parameters, or internal metadata - into data streams, API responses, or rendered output accessible to unauthorized or insufficiently privileged parties. In the context of a backup plugin, sensitive data likely includes backup file paths, database credentials, server configurations, or file system structure details that are embedded in plugin responses. The 'Subscriber' qualifier in the vulnerability title is significant in the WordPress user role model: subscribers are the lowest-privilege authenticated role, suggesting the plugin may expose sensitive output to any logged-in WordPress user, or alternatively exposes subscriber-related PII/data to unauthenticated requestors. The CVSS vector supplied (PR:N, C:N) presents inconsistencies with the CWE-201 classification and the 'subscriber' framing that warrant independent verification.
RemediationAI
The primary remediation is to update the XCloner plugin beyond version 4.8.6 immediately; however, an exact patched release version is not independently confirmed from the available data - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/xcloner-backup-and-restore/vulnerability/wordpress-xcloner-plugin-4-8-6-sensitive-data-exposure-vulnerability and the official WordPress plugin repository for the latest release. If an updated version is not yet available, the most effective compensating control is to deactivate the XCloner plugin entirely until a patch is applied, accepting the trade-off of losing automated backup scheduling. If deactivation is not operationally viable, restrict the WordPress site to trusted users only (remove public registration, audit subscriber accounts), and ensure backup files and directories are stored outside the web root and protected by server-level access controls (e.g., deny all in .htaccess for the backup storage path). Do not expose wp-admin or plugin REST endpoints to untrusted networks without authentication enforcement at the WAF or reverse proxy layer.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today