What is the CVSS score of EUVD-2026-45132?

EUVD-2026-45132 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

pCloud WP Backup EUVD-2026-45132

| CVE-2026-14503 MEDIUM

Information Exposure (CWE-200)

2026-07-17 Wordfence

GHSA-6qxr-g8rc-cpg3

PHP WordPress Information Disclosure Wordpress Plugin Pcloud Wp Backup

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network AJAX endpoint exploitable with subscriber-level credentials (PR:L); confidentiality is high due to wp-config.php and salt exposure; no integrity or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 05:16 vuln.today

CVE Published

Jul 17, 2026 - 03:43 cve.org

MEDIUM 6.5

DescriptionCVE.org

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.

AnalysisAI

Sensitive information exposure in the pCloud WP Backup WordPress plugin (all versions up to and including 2.0.3) allows subscriber-level authenticated users to trigger full-site backup archive generation via the unprotected wp2pcl_ajax_process_request_inner AJAX endpoint. The resulting archive is deposited in the plugin's publicly web-accessible tmp/ directory at a predictable URL, exposing wp-config.php database credentials, WordPress authentication secret salts, and the complete PHP source tree to unauthenticated HTTP retrieval by any internet visitor. No public exploit code has been identified at time of analysis, but the two-phase attack path (low-privilege trigger followed by unauthenticated exfiltration) makes this significantly more impactful than the 6.5 CVSS score suggests, as successful exploitation provides the material for full database access and authentication session forgery.

Technical ContextAI

The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The affected AJAX handler wp2pcl_ajax_process_request_inner, visible in the WordPress plugin repository source at pcloud-wp-backup.php (lines 210, 217, 572, 1635) and Pcloud/Classes/class-wp2pcloudfilebackup.php (line 111), fails to enforce adequate authorization checks before executing backup generation logic. WordPress's subscriber role is the lowest authenticated user role, obtainable through self-registration on sites with open registration enabled. The backup archive is written to the plugin's tmp/ subdirectory, which resides within the publicly web-served WordPress directory tree and lacks any access restriction mechanism (no .htaccess deny rule, no index.php empty guard). The archive filename is predictable rather than randomized, enabling targeted unauthenticated retrieval. The contents of wp-config.php - the single most sensitive file in any WordPress installation - include the MySQL database hostname, name, username, and password, as well as all WordPress authentication keys and salts used to sign and verify session cookies. CPE cpe:2.3:a:ploudapp:pcloud_wp_backup:*:*:*:*:*:*:*:* identifies the affected product across all versions through 2.0.3.

RemediationAI

Update the pCloud WP Backup plugin to the version incorporating WordPress plugin repository changeset 3597399; the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/0b301c6e-a3c5-4435-9bc9-fab18085fe2d should be consulted for the confirmed patched release version once published. If immediate update is not possible, deactivate or uninstall the plugin as the most effective compensating control - this eliminates all attack surface at the cost of losing plugin-provided backup functionality entirely. As a partial mitigation that does not remove the trigger risk, add an .htaccess rule to the plugin's tmp/ directory containing deny from all to block unauthenticated archive retrieval; note this addresses only Phase 2 of the attack and an attacker with subscriber access could still repeatedly trigger backup generation, consuming server resources and leaving archives unretrievable but still generated. Additionally, disable open WordPress user registration (Settings > General > Membership) to raise the entry bar for Phase 1, recognizing that this does not protect sites where subscriber accounts already exist or have been compromised.