EUVD-2026-89904
GHSA-9chx-8rmg-3r3g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running StifLi Backup Tools ≤2.2.7
-
ExploitSend crafted HTTP request to exposed backup endpoint
-
ExecutionRetrieve unauthenticated backup/sensitive data
-
ImpactHarvest credentials/DB dump/PII for follow-on compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Exploitable against any default installation of the StifLi Backup Tools WordPress plugin at version 2.2.7 or earlier - no authentication, no user interaction, and no special configuration are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The practical prerequisite is that the plugin be installed and active and that the attacker can reach the site over the network; the limiting factor is the plugin's low deployment footprint and the need to know or discover the exposed backup/endpoint path (the advisory does not disclose it). Impact is confidentiality-only (no data modification or denial of service). |
| Impact | This is a moderate-to-notable real-world risk that scores meaningfully higher in practical impact than its niche footprint might suggest. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) indicates remote, unauthenticated, low-complexity exploitation requiring no user interaction, with high confidentiality impact and no integrity or availability effect - consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data) and the 'Unauthenticated Sensitive Data Exposure' description. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no signal of active or automated exploitation at this time; the 7.5 rating is driven purely by the ease of access and the confidentiality-only impact, not by observed attacks. The critical aggravating factor is the product class: this is a BACKUP plugin, so the 'sensitive data' exposed is disproportionately valuable (database dumps, wp-config credentials, user PII, secrets) compared to a generic info-leak. Signals are consistent rather than conflicting; the main missing data is the exact exposed endpoint/file path and mechanism (the Patchstack description is sparse), which should be verified against the vendor/Patchstack advisory before confirming exploitability details. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker requests a predictable or discoverable backup artifact or plugin endpoint on a WordPress site running StifLi Backup Tools <= 2.2.7 and retrieves sensitive data (e.g., database backups, configuration secrets, or user records) without any credentials. No public exploit code was identified in the provided data, but the attack requires only a crafted HTTP request and no user interaction, making opportunistic scanning feasible once the exposed path is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.
RemediationAI
Patch status: no vendor-released patch version is identified in the available intelligence at the time of analysis, so affected administrators cannot yet upgrade to a fixed release and must rely on compensating controls. The most reliable mitigation is to deactivate and delete the StifLi Backup Tools plugin if backups are handled elsewhere, which removes the exposure entirely but forfeits the plugin's functionality; if it must stay active, restrict access to its request surface - deny anonymous requests to the plugin's directory (/wp-content/plugins/stifli-backup-tools/ and any of its PHP files) and to the specific admin-ajax.php actions or REST routes the plugin registers - via web-server rules or a WAF, understanding that the advisory does not disclose the exact endpoint so the block may need to be narrowed or broadened based on observed traffic and that legitimate administrator backup operations may break if the rule is too broad. Additionally, require authentication at the edge for those paths (HTTP basic auth or an IP allowlist limited to administrator networks), with the trade-off that this adds friction and can break scheduled or automated backup jobs, and review logs for anonymous hits against plugin paths to detect probing. Because the leaked data may include credentials or backup contents, treat any exposure on an affected site as a potential credential compromise and rotate relevant secrets. Monitor the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/stifli-backup-tools/vulnerability/wordpress-stifli-backup-tools-plugin-2-2-7-sensitive-data-exposure-vulnerability?_s_id=cve and the WordPress.org plugin page for a fixed version, and upgrade as soon as one is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data): the plugin emits sensitive content in responses to requests that are not subject to an authorization or capability check. In WordPress terms this typically means an AJAX action, REST route, or directly requestable PHP file inside the plugin directory that relies on the calling page for its access control rather than performing a current_user_can() / nonce check server-side - the classic pattern in which a handler intended only for authenticated administrators is reachable by direct HTTP GET/POST. Because the CVSS vector is PR:N with no UI:N qualifier, the exposed response is served to anonymous requesters over the network with no session, token, or user interaction needed, and the S:U scope and C:H/N/I:N/A:N profile indicate the leak is confined to the confidentiality of data the plugin itself holds (for example backup archives, file listings, paths, or stored configuration/secrets) without lateral impact on the rest of the WordPress installation. The CPE cpe:2.3:a:esteban:stifli_backup_tools:*:*:*:*:*:*:*:* identifies the affected component as the plugin authored under the 'esteban' vendor namespace and records no version floor, i.e. the advisory treats the whole plugin history up to 2.2.7 as vulnerable. This is a pure WordPress-plugin class issue: the underlying platform is not at fault, but WordPress's habit of registering unauthenticated admin-ajax.php and REST endpoints makes discovering and invoking such handlers straightforward once the plugin slug is known.
Know when Stifli Backup Tools gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network access with no interaction yields AV:N/AC:L/PR:N/UI:N; sensitive backup data exposure is confidentiality-only, so C:H with I:N/A:N and S:U.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions.
Executive ViewAI
An unauthenticated information-disclosure flaw in the WordPress plugin StifLi Backup Tools (all versions through 2.2.7) allows any remote party who can reach an affected site to retrieve backup-related data the plugin was never meant to expose, without any login or user interaction. Because leaked backup metadata and files often contain credentials, configuration secrets, or database content, the exposure creates a direct pathway to credential theft and follow-on compromise of the hosting site and any systems those credentials unlock. Leadership should care because the affected sites are internet-facing, remediation cannot rely on a vendor fix, and the breach of trust from exposed backup data typically outpaces the technical scope of the flaw itself.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the StifLi Backup Tools plugin (all versions through 2.2.7 are affected); where removal is not immediately feasible, block or restrict access to the plugin's endpoints and backup directories at the WAF, reverse proxy, or web server level and limit them to trusted administrative IP ranges; disable directory listing and direct file access to backup storage paths; audit logs for evidence of endpoint enumeration or data retrieval; and rotate any credentials, keys, or secrets that may have been present in exposed backup content.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB