The Backup Bolt plugin for WordPress contains a flaw in the process_backup_batch() function that lets an authenticated user with Administrator rights download files from outside the web root and write backup zip archives to arbitrary paths. This enables disclosure of sensitive files and uncontrolled storage of potentially malicious archives, exposing both confidentiality and integrity of the application and underlying server. The weakness is identified as CWE-73.

All WordPress sites running Backup Bolt version 1.4.1 or earlier are affected. The vulnerability applies to any installation where the plugin is activated and administrative access is available.

The measured CVSS score of 3.8 indicates low overall severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploit requires authenticated Administrator-level access, and the attacker can use the backup functionality to specify arbitrary file paths, making the attack vector likely to involve an insider or compromised administrator account rather than external traffic.