{"id":"CVE-2026-97241","published":"2026-09-30T13:17:35.887","lastModified":"2026-09-30T14:18:15.073","description":"Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-201"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/backupease/vulnerability/wordpress-backupease-plugin-2-2-2-sensitive-data-exposure-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"BackupEase versions 2.2.2 and earlier have an unauthenticated sensitive data exposure vulnerability where attackers can access backup configuration files and credentials without any authentication. This allows unauthorized users to extract sensitive backup data and potentially gain access to underlying systems.","exploitability":"The vulnerability is highly exploitable as it requires no authentication or user interaction, with attackers able to directly access sensitive backup files through unauthenticated API endpoints or web interfaces.","blast_radius":"The impact could be significant across all BackupEase installations running versions 2.2.2 or earlier, potentially exposing backup credentials, configuration data, and sensitive backup files to any external attacker.","remediation":"Upgrade to BackupEase version 2.2.3 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["data-exfiltration","unauthenticated-access","backup-system"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:04:49.226Z"}}