WordPress Plugin Backup Migration version 1.2.8 contains an information disclosure flaw that permits unauthenticated actors to retrieve entire database backups by requesting predictable file paths. The flaw allows attackers to construct direct download URLs after discovering backup directories through configuration files and logs, resulting in the extraction of sensitive data such as user credentials, configuration settings, and potentially customer information. This issue is identified as CWE‑538, reflecting the exposure of confidential logs or data.

The vulnerability affects the Backupbliss WordPress Plugin Backup Migration product specifically at version 1.2.8. No other versions or products are listed in the current data.

The CVSS score of 8.7 classifies this as a high severity flaw, and the lack of an EPSS score suggests that exploitation likelihood cannot be precisely quantified, but the unauthenticated nature and predictable URLs indicate an easy attack path. The flaw is not listed in the CISA KEV catalog and no official workaround is publicly documented. If exploited, the attacker could achieve full database compromise, leading to a complete confidentiality breach of sensitive business and user data.