Swish Migrate And Backup
Monthly
Unauthenticated sensitive data exposure in the WordPress plugin Swish Migrate and Backup (versions 1.4.0 and earlier) lets remote attackers retrieve data the plugin should have kept private, with the impact confined to confidentiality (CVSS 5.9, C:H/I:N/A:N). Exploitation is not trivial: the CVSS vector (AV:N/AC:H/PR:N/UI:N) marks high attack complexity, meaning a specific transient or plugin-operation condition - such as a backup or migration in progress, or an exposed backup artifact - must be met before the leak occurs, and the available data does not identify the exact trigger. At time of analysis no public exploit code has been identified, the issue was reported by Patchstack, and it is a moderate-priority information disclosure rather than a top-tier emergency; the niche deployment of this plugin further limits realistic exploitation.
Unauthenticated sensitive data exposure in the WordPress plugin Swish Migrate and Backup (versions 1.4.0 and earlier) lets remote attackers retrieve data the plugin should have kept private, with the impact confined to confidentiality (CVSS 5.9, C:H/I:N/A:N). Exploitation is not trivial: the CVSS vector (AV:N/AC:H/PR:N/UI:N) marks high attack complexity, meaning a specific transient or plugin-operation condition - such as a backup or migration in progress, or an exposed backup artifact - must be met before the leak occurs, and the available data does not identify the exact trigger. At time of analysis no public exploit code has been identified, the issue was reported by Patchstack, and it is a moderate-priority information disclosure rather than a top-tier emergency; the niche deployment of this plugin further limits realistic exploitation.