EUVD-2026-39681
GHSA-f5x4-57q2-55jv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable IDOR exposing backup data gives AV:N/AC:L/PR:N/UI:N with high confidentiality impact and no integrity or availability effect.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions.
AnalysisAI
Sensitive data exposure in the Trinity Backup WordPress plugin (versions 2.0.9 and earlier) allows remote unauthenticated attackers to retrieve confidential information without any credentials. Because the plugin manages full-site backups, the exposed data may include database dumps, configuration files, and credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected feature is the Trinity Backup plugin's backup data handling on a WordPress site running version 2.0.9 or earlier; per CVSS PR:N/UI:N the exposed endpoint is reachable without authentication and without user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality impact and no integrity or availability impact - a clean read-only data-disclosure profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote attacker enumerates WordPress sites running Trinity Backup and sends a crafted unauthenticated request to the plugin's backup-retrieval endpoint, manipulating a user-controlled identifier to reference stored backup data. The server returns the sensitive backup contents - potentially a full database export containing user credentials and secrets - without prompting for authentication. … |
| Remediation | No vendor-released patch identified at time of analysis; the input does not specify a fixed version, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/trinity-backup/vulnerability/wordpress-trinity-backup-backup-migrate-restore-clone-schedule-backups-plugin-2-0-9-sensitive-data-exposure-vulnerability?_s_id=cve) and the WordPress plugin repository for any release above 2.0.9 and upgrade to it once confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress instances to identify Trinity Backup plugin installations and document affected versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today