WordPress Web Plura Backup & Restore Manager Plugin Sensitive Data Exposure
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.
Summary
Web Plura Backup & Restore Manager for WordPress, versions 0.2.25 and earlier, exposes sensitive data to unauthenticated users over the network. CWE-201 (Insertion of Sensitive Information Into Sent Data) covers the flaw. CVSS 3.1 scores it 7.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, meaning high confidentiality impact only. CISA has not added it to KEV, and CISA's SSVC rates exploitation as none, automatable as yes and technical impact as partial.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version is listed for Web Plura Backup & Restore Manager. Remove the plugin or restrict access to its functions until the vendor publishes a fix.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-11 Threatist record created from CVE-2026-42630
- 2026-10-11 Alias added: GHSA-7w4w-54qj-jphg
Sources
- CVE-2026-42630 · CVE Program
- CVE-2026-42630 · NVD
- FIRST EPSS
- GHSA-7w4w-54qj-jphg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences