Norvis Backup EUVD-2026-93049

The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, user interaction, or special configuration is required - remote unauthenticated exploitation against affected installations of the Norvis Backup WordPress plugin (versions <= 1.1.0). The primary limiting factor is deployment: the site must actually run this specific, low-prevalence plugin at a vulnerable version. The input description does not name the exact vulnerable endpoint, parameter, or whether a non-default setting (e.g., a particular backup-storage or sharing mode) is involved, so the precise trigger could not be extracted and should be verified against the Patchstack advisory; no evidence suggests a non-default configuration is required.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, base 7.5 HIGH) signals a remotely reachable, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - consistent with a pure information-disclosure issue (CWE-201). All signals point the same direction on ease of access, but the real-world priority is tempered by missing exploitation-intelligence signals: no EPSS score was provided, the vulnerability is NOT on the CISA KEV list, and no public proof-of-concept is indicated in the input. Thus there is no public exploit identified at time of analysis and no confirmation of active exploitation. The disclosing source is Patchstack (a reputable WordPress-focused vulnerability database), which lends credibility to the finding, but the one-line description does not name the specific endpoint, parameter, or data exposed, so the exact sensitivity of the leaked data cannot be confirmed from available data. Net assessment: easy to exploit if an attacker targets a vulnerable site, but likely moderate rather than top-tier priority given the plugin's apparently small footprint and absence of exploitation evidence - patch on a normal cadence unless the affected plugin is confirmed present, in which case prioritize due to the unauthenticated nature.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running Norvis Backup <= 1.1.0 and retrieves sensitive data (likely backup contents or configuration) that should not be publicly accessible. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required. No public proof-of-concept is identified at time of analysis.