{"id":"CVE-2026-42630","published":"2026-10-10T20:16:34.717","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/web-plura-backup-restore-manager/vulnerability/wordpress-web-plura-backup-restore-manager-plugin-0-2-25-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Web Plura Backup & Restore Manager plugin exposes sensitive data to unauthenticated users through a vulnerable endpoint in versions up to 0.2.25. This allows attackers to access backup files, configuration details, and potentially other sensitive information without requiring any authentication.","exploitability":"Exploitation is straightforward with no prerequisites, as the vulnerability affects an unauthenticated endpoint that directly exposes sensitive data.","blast_radius":"The impact could be significant in environments where this plugin is deployed, potentially exposing database backups, configuration files, and other sensitive data to attackers who can access the vulnerable endpoint.","remediation":"Upgrade to version 0.2.26 or later to remediate this sensitive data exposure vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfil","web","backup"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:11:19.087Z"}}