Backupease
Monthly
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.
Unauthenticated sensitive data exposure in the WordPress plugin BackupEase through version 2.2.2 lets any remote, network-reachable visitor retrieve information the plugin was never intended to expose, with confidentiality impact rated High and no integrity or availability effect (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no account, credential, or victim interaction is required - the only prerequisite is that the plugin be installed at an affected version and its vulnerable endpoint reachable over HTTP(S). There is no public exploit identified at time of analysis, the issue is not confirmed actively exploited (no CISA KEV listing), and no EPSS score was provided in the available intelligence; Patchstack is credited as the reporting source.