{"id":"CVE-2026-105071","published":"2026-10-06T09:17:40.893","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration &amp; Cloning <= 1.5.17 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/sitevault-backup-restore-migration/vulnerability/wordpress-sitevault-backup-restore-migration-cloning-plugin-1-5-17-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A sensitive data exposure vulnerability in SiteVault allows unauthenticated attackers to access backup, restore, migration, and cloning functionality without requiring authentication. This flaw enables unauthorized users to potentially extract confidential data from affected systems.","exploitability":"The vulnerability is highly exploitable as it requires no authentication or user interaction, with attackers able to directly access sensitive endpoints using basic HTTP requests.","blast_radius":"The impact could be significant across multiple affected installations, potentially exposing backup files, configuration data, and system credentials that were previously protected by authentication mechanisms.","remediation":"Upgrade to SiteVault version 1.5.18 or later to remediate this sensitive data exposure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfiltration","unauthenticated-access","backup"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:16.760Z"}}