Swish Migrate Backup EUVD-2026-96543

The flaw is an unauthenticated (PR:N) sensitive data exposure in Swish Migrate and Backup for WordPress, versions 1.4.0 and below, reachable over the network without user interaction. However, CVSS marks attack complexity HIGH (AC:H), indicating exploitation is NOT trivial against a default install - it requires some special condition the attacker cannot fully control (e.g., a specific timing/race, a transient backup file being present, or a particular plugin operation in progress). The available data does not name the exact feature, endpoint, or configuration setting that must be active, so defenders should consult the Patchstack advisory to confirm the precise trigger. Limiting factors: the AC:H condition and the niche deployment of this plugin constrain realistic exploitation; impact is confined to confidentiality (data leak) with no integrity or availability effect.

This is a moderate-severity information disclosure flaw (CVSS 5.9) rather than a top-tier priority. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates a network-reachable, unauthenticated issue, which raises concern, but the HIGH attack complexity (AC:H) means exploitation depends on conditions outside the attacker's control (e.g., winning a race, specific timing, or non-default state), tempering real-world exploitability. The only confirmed impact is confidentiality (C:H/I:N/A:N) - sensitive data exposure with no integrity or availability effect - consistent with CWE-201. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization; this reads as a high-confidentiality-impact but lower-likelihood issue. The combination of PR:N and a backup/migration plugin (which inherently handles sensitive site data) means a successful exploit could leak credentials or database contents, so it should be patched, but the AC:H qualifier argues against treating it as an emergency. Note: CVSS marks this unauthenticated (PR:N) yet rates complexity HIGH - the exact trigger condition is not described in the available data and should be verified against the Patchstack advisory.

A remote, unauthenticated attacker targets a WordPress site running Swish Migrate and Backup <= 1.4.0 and, by meeting the specific (high-complexity) trigger condition, requests or accesses an exposed backup/migration artifact or endpoint that returns sensitive data. Because backup plugins bundle database dumps, credentials, and configuration, the leaked data could enable further compromise. No public exploit code is identified at time of analysis.