What is the CVSS score of EUVD-2026-93088?

EUVD-2026-93088 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

How to fix or mitigate EUVD-2026-93088?

Within 24 hours, inventory all WordPress sites for SiteVault - Backup, Restore, Migration & Cloning version 1.5.17 or earlier and, where business operations permit, deactivate or remove the plugin from internet-facing sites; if deactivation is not immediately possible, block access to the plugin's endpoints at the edge/WAF, restrict plugin paths by source IP where feasible, and rotate any credentials, API keys, or secrets that may have been stored in plugin-accessible data. Within 7 days, confirm whether any site must retain the plugin, apply virtual patching or temporary WAF rules for the sensitive-data exposure, enable enhanced logging and alerting for unauthenticated requests to plugin paths, and review backups and configuration files for unexpected access or exposure. Within 30 days, remove or replace the plugin on sites where it is not essential, continue monitoring the vendor and Patchstack advisories for a patched version, and apply the vendor-released patch as soon as an exact fixed version is published; if no patch becomes available, keep the plugin deactivated or compensated by permanent access controls and periodic exposure checks.

SiteVault EUVD-2026-93088

| CVE-2026-105071 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-10-06 Patchstack

GHSA-7jm2-9g83-27p4

WordPress Information Disclosure Wordpress Plugin Sitevault Backup Restore Migration Amp Cloning

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running SiteVault <= 1.5.17
Exploit

Send crafted unauthenticated HTTP request
Execution

Trigger sensitive data exposure endpoint
Impact

Exfiltrate backup/configuration data

Vulnerability Assessment

Weakness	CWE CWE-201 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Outbound data filtering
Exploitation Conditions	Exploitation requires that the target WordPress site has the SiteVault - Backup, Restore, Migration & Cloning plugin (by royal_plugins) installed and active at version 1.5.17 or earlier; the vulnerability is in the plugin itself, not core WordPress. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required - exposure is reachable remotely against affected installations by default. The primary limiting factor is therefore install base and version: sites on a fixed/later release or without the plugin are unaffected. The exact feature or endpoint that leaks data is not detailed in the provided reference and should be confirmed via the Patchstack advisory.
Impact	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH) describes a fully remote, low-complexity, unauthenticated flaw with high confidentiality impact but no integrity or availability impact - consistent with the CWE-201 sensitive data exposure classification and the 'Unauthenticated Sensitive Data Exposure' description from Patchstack. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or weaponization; this is no public exploit identified at time of analysis. The realistic priority is moderated by product footprint: this is a specific WordPress backup/migration plugin ('SiteVault' by royal_plugins), not a ubiquitous component, so despite the unauthenticated-read profile that typically attracts opportunistic scanning, mass-scale impact depends on install base. SSVC inputs (exploitation status, automatable, technical impact) were not supplied in the input and cannot be computed here. Net: a genuinely reachable unauthenticated information-disclosure bug worth patching promptly on any affected site, but no current evidence elevating it to emergency status; EPSS/KEV/POC data is MISSING and should be rechecked before deprioritizing.
Exploit ScenarioDerived	A remote, unauthenticated attacker sends crafted HTTP requests to a WordPress site running SiteVault <= 1.5.17 and retrieves sensitive data exposed by the plugin (e.g., backup contents, configuration, or credentials handled during backup/restore/migration operations). Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required. No public proof-of-concept was identified in the provided data.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 06, 2026

Unauthenticated sensitive data exposure in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (by royal_plugins) at version 1.5.17 and earlier lets remote attackers retrieve sensitive information from affected sites without authentication, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (base 7.5 HIGH). Only sites with the plugin installed and active at or below 1.5.17 are exposed; the impact is high confidentiality loss with no integrity or availability effect, consistent with the CWE-201 sensitive-data-exposure classification reported by Patchstack. No public exploit code has been identified at time of analysis, no CISA KEV listing applies, and no EPSS score was supplied, so the practical risk is driven mainly by the plugin's install base and the ease of unauthenticated, low-complexity remote exploitation.

RemediationAI

No fixed version is identified in the supplied data, so treat 1.5.17 as the last known-vulnerable release and check the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sitevault-backup-restore-migration/vulnerability/wordpress-sitevault-backup-restore-migration-cloning-plugin-1-5-17-sensitive-data-exposure-vulnerability?_s_id=cve for the vendor-released update; upgrade to the first patched version once it is named and verified. Until a patched release is confirmed available, the most effective compensating control is to deactivate and, if feasible, uninstall the plugin - the trade-off is loss of scheduled backups, restore and migration functionality - or, if it must stay active, restrict it to trusted administrators and block unauthenticated access to its routes at the edge. Concretely, use a WAF or reverse-proxy rule to deny external requests to the plugin directory and its known AJAX/admin-ajax.php actions and to any backup/export/download endpoints while permitting only expected administrative traffic; note that a WAF or IP allow-list can be bypassed or may break legitimate scheduled jobs and admin workflows, so test before enforcement. Restrict administrative access with strong authentication and MFA, and because CWE-201 means sensitive data was emitted, rotate exposed secrets such as database credentials and WordPress security salts, rotate any backup storage keys, and audit web and plugin access logs for requests to the plugin's endpoints to determine whether data was actually retrieved.

Affected VersionsENISA

SiteVault – Backup, Restore, Migration & Cloning n/a ≤1.5.17

Affected Packages

euvd sitevault_backup_restore_migration_amp_cloning no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The flaw lives in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning, a backup/restore/migration utility, and is tracked as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the application places sensitive content into data it transmits or otherwise makes retrievable without adequate protection. Because such plugins routinely handle database dumps, site configuration, migration manifests and file archives, the affected code path is most likely an endpoint that returns or exposes that content to a requesting party without authorization checks - the exact feature or route is not detailed in the supplied reference and should be confirmed against the Patchstack advisory. The CPE record cpe:2.3:a:royal_plugins:sitevault_-_backup,_restore,_migration_&_cloning:*:*:*:*:*:*:*:* confirms the affected component is the plugin from the royal_plugins vendor rather than WordPress core, and the ENISA EUVD entry (EUVD-2026-93088) independently lists the same affected range of versions 1.5.17 and below. The assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates the surface is network-reachable with low attack complexity, requires no privileges or interaction, and yields strictly confidentiality impact within a single security authority.

Know when Wordpress Plugin gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Unauthenticated remote data exposure (AV:N/AC:L/PR:N/UI:N) per the description; confidentiality-only impact under CWE-201, so C:H with I:N/A:N and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in SiteVault - Backup, Restore, Migration & Cloning <= 1.5.17 versions.

Executive ViewAI

Why It Matters

SiteVault - Backup, Restore, Migration & Cloning (royal_plugins) version 1.5.17 and earlier exposes sensitive site data to unauthenticated remote attackers, putting any organization using the plugin on WordPress at risk of confidentiality loss. While no public exploit identified at time of analysis, the lack of a vendor-released patch and the plugin's backup/migration function mean exposed data could include credentials or site content, requiring immediate inventory and containment.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing the vulnerable plugin, blocking access to plugin endpoints with a WAF or edge controls, restricting plugin access by IP allowlist, rotating exposed credentials/secrets, and monitoring logs for unauthenticated requests to plugin paths.

Threat Intelligence Overview

EPSS Score

0.4%

Top 68% exploitable

Prevalence

Low

niche WordPress backup/migration plugin, limited install base

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.