Norvis Backup
Monthly
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.
Unauthenticated information disclosure in the Norvis Backup WordPress plugin (versions up to and including 1.1.0) allows any remote attacker to retrieve sensitive site data without credentials, user interaction, or special configuration, as reflected by the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N with high confidentiality impact (base 7.5 HIGH) and no integrity or availability impact. The flaw is a CWE-201 sensitive-information-in-sent-data issue in a low-prevalence backup plugin, so exposure is limited to sites actually running this plugin at a vulnerable version. There is no public exploit identified at time of analysis, and no vendor-released patch version was confirmed in the available data; the sole source is the Patchstack advisory.