The Shortcode Cleaner Lite plugin contains a missing capability check in its download_backup() function. As a result, any authenticated user with Subscriber-level access and above can call this function and export arbitrary options from the WordPress database. This allows an attacker to pull sensitive configuration data, potentially compromising site integrity and privacy. The flaw is a classic missing authorization issue, classified as CWE‑862.

The issue affects the Shortcode Cleaner Lite WordPress plugin by the vendor mandooox. All releases up to and including version 1.0.9 are vulnerable. WordPress sites that have installed any of these releases are exposed.

With a CVSS score of 6.5 the vulnerability is of moderate severity. The EPSS score is below 1%, indicating that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Because the exploit requires only a normal authenticated subscriber account, an attacker does not need elevated privileges or remote code execution, but can still unfetteredly download site options.