{"id":"CVE-2026-42413","published":"2026-10-06T09:17:54.170","lastModified":"2026-10-06T15:04:25.990","description":"Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/snapshotify/vulnerability/wordpress-snapshotify-all-in-one-backup-restore-migrate-plugin-1-3-2-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Snapshotify backup plugin exposes sensitive data without authentication in versions up to 1.3.2, allowing attackers to access backup configurations, credentials, and potentially other sensitive information.","exploitability":"Exploitation is straightforward with no prerequisites since the vulnerability affects unauthenticated endpoints that expose sensitive backup data.","blast_radius":"The impact could be significant as attackers may gain access to complete backup configurations, including database credentials, file paths, and other sensitive system information that could enable further attacks or data exfiltration.","remediation":"Upgrade to version 1.3.3 or later to address the sensitive data exposure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfil","backup","unauth","sensitive-data"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:06:49.958Z"}}