The XCloner plugin for WordPress is vulnerable to Cross‑Site Request Forgery in the Xcloner_Remote_Storage:save() function due to missing or incorrect nonce validation. An unauthenticated attacker can forge a request that, if an administrator clicks a malicious link, adds or modifies an FTP backup configuration. The attacker can set the backup target to a server under their control, thereby exfiltrating potentially sensitive site data. The weakness is a classic CSRF flaw (CWE-352) that compromises the confidentiality of stored content.

WordPress sites using the Backup, Restore and Migrate your sites with XCloner plugin by watchful. All plugin versions up to and including 4.8.2 are affected. Subsequent releases are not affected.

The vulnerability has a CVSS score of 4.3, indicating a low‑to‑moderate impact. The EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a CSRF scenario that requires an administrator to click a malicious link or submit a forged request; authentication is not required to perform the action.