EUVD-2026-89905
GHSA-cqgw-mhvm-4ffv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running BackupEase <=2.2.2
-
ExploitSend unauthenticated HTTP request to exposed endpoint
-
ExecutionRetrieve sensitive backup/data files
-
ImpactHarvest credentials or database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
|
| Exploitation Conditions | Exploitation requires only that the target WordPress site have the BackupEase plugin at version 2.2.2 or earlier installed and network-reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration prerequisite stated. The primary limiting factor is deployment scope - the plugin must be present and its vulnerable endpoint reachable over HTTP(S) - rather than any configuration toggle. The description does not name a required feature or non-default mode, so exploitation is assumed against default installations of the affected version. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) describes a fully remote, unauthenticated, low-complexity confidentiality-only disclosure - internally consistent with a base score of 7.5 (HIGH). All exploitation signals beyond CVSS are ABSENT in the provided data: no EPSS probability score, no CISA KEV listing, no public POC, and no SSVC decision fields are supplied by the sole source (Patchstack). Consequently this reads as a genuinely reachable pre-auth issue on paper, but with no evidence of active or imminent exploitation - the real-world urgency rests on the plugin's install base, which is not indicated. The description is sparse ('Unauthenticated Sensitive Data Exposure') and names no specific endpoint, parameter, or exposed artifact, so the exact data at risk (plausibly backup archives, DB dumps, or credentials given the plugin's backup function) is inferred, not confirmed. Treat as a real but moderate priority pending confirmation of exposed data type and deployment footprint; no signal contradicts the CVSS vector. |
| Exploit ScenarioDerived | A remote attacker with no account sends a crafted HTTP request to the BackupEase plugin (<= 2.2.2) on a target WordPress site and retrieves sensitive backup-related data - such as database dumps or archive files - without authentication or user interaction. No public exploit code is identified at time of analysis, but the network, no-privilege vector makes discovery straightforward once the vulnerable endpoint is known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.
RemediationAI
The supplied intelligence does not identify an exact patched version, so the primary action is to check the BackupEase plugin page and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/backupease/vulnerability/wordpress-backupease-plugin-2-2-2-sensitive-data-exposure-vulnerability) for a fixed release and update as soon as one is published. Because the endpoint is reachable without authentication (PR:N/UI:N), patching is the only complete fix; until a patched version is confirmed installed, deactivate and, if possible, uninstall the plugin on any site that does not actively need it - the trade-off is loss of scheduled backup functionality, which should be replaced by an independent backup mechanism before deactivation, not after. If the plugin must remain active, restrict reachability of the plugin's endpoints at the web server or reverse proxy (deny requests routed to the plugin directory except from trusted administrative IP ranges) and add WAF rules to block unauthenticated requests to BackupEase endpoints, accepting that legitimate cron or remote-storage callbacks may also be blocked and will need allow-listing. Rotate any credentials, API tokens, or storage keys that BackupEase stored or processed, since exposed configuration secrets should be treated as compromised even before exploitation is confirmed. Note that no vendor-released patch version is confirmed in the available data, and no public exploit code was identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin's own response payload - served by a WordPress endpoint reachable without authentication - includes data that should have been withheld or redacted before transmission. Backup plugins are structurally exposed to this class of bug because they routinely handle database dumps, stored archive paths, remote-storage credentials, and routinely read wp-config.php values; when such content is echoed back in an HTTP response rather than filtered, the disclosure is complete in a single request. The CPE cpe:2.3:a:precisionwp:backupease:*:*:*:*:*:*:*:* attributes the code to the 'precisionwp' vendor and marks the wildcard version range as affected, which is consistent with the description's 'versions <= 2.2.2' boundary. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a fully remote, unauthenticated, low-complexity read-only disclosure scoped to the vulnerable component - internally consistent with the 7.5 HIGH base score - so the root cause is an output-handling / data-exposure defect rather than an injection, authentication-bypass, or code-execution primitive.
Know when Backupease gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated remote data exposure with no user interaction gives AV:N/AC:L/PR:N/UI:N; confidentiality-only disclosure per CWE-201 sets C:H with I:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.
Executive ViewAI
The BackupEase WordPress plugin, in versions through 2.2.2, can expose sensitive information to unauthenticated remote users, creating confidentiality risk for any organization hosting an affected WordPress site. Leadership should care because exposed backup-related data can drive regulatory, customer-trust, and follow-on attack risk, even without integrity or availability impact. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include disabling or removing the BackupEase plugin on affected WordPress sites, restricting access to its endpoints via web server or WAF rules, and monitoring and rotating any sensitive data that may have been exposed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB