Stifli Backup Tools
Monthly
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.
Unauthenticated sensitive data exposure in the WordPress plugin StifLi Backup Tools affects all versions up to and including 2.2.7, allowing any remote attacker who can reach an affected site to retrieve information the plugin was never intended to expose without logging in first (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only - no data modification or denial of service - so the practical damage is the leak of backup-related information that could feed follow-on attacks such as credential theft or targeted exploitation. At the time of analysis there is no public exploit code identified and no confirmation of active exploitation (the CVE is not in CISA KEV), though the low attack complexity and zero authentication requirement make the flaw trivially reachable for anyone who knows or discovers the exposed endpoint; no EPSS score was supplied, and the risk is moderated mainly by the plugin's niche deployment footprint rather than by any technical barrier.