{"id":"CVE-2026-41560","published":"2026-10-06T09:17:53.730","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wxd-backup-lite/vulnerability/wordpress-wxd-backup-lite-plugin-1-0-2-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"WXD Backup Lite suffers from unauthenticated broken access control that allows attackers to bypass authentication and access protected backup functionality without any credentials. This vulnerability is particularly dangerous because it affects a backup tool that likely handles sensitive data, making unauthorized backups or data exposure possible.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability allows full access to backup functions without authentication, requiring only network access to the affected system.","blast_radius":"The impact could be significant if exploited, potentially allowing attackers to access sensitive backup data, perform unauthorized backups, or manipulate backup configurations across all versions up to 1.0.2.","remediation":"Upgrade to version 1.0.3 or later to remediate this vulnerability, as the vendor has released a patch specifically addressing the broken access control issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["backup","access-control","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:07:04.094Z"}}