The vulnerability is an insertion of sensitive information into log files performed by the WebToffee WordPress Backup & Migration plugin. An attacker can trigger the plugin to write private data such as authentication tokens or database credentials into its log, leading to a confidentiality breach. The flaw maps to CWE‑532: Logging of Sensitive Information.

Affected systems are WordPress sites that have the WebToffee Backup & Migration plugin installed in any version up to and including 1.5.3. The vendor is WebToffee and the product is the WordPress Backup & Migration plugin. Users of older or unpatched releases are at risk.

The CVSS score of 5.9 indicates moderate impact, while the EPSS score of less than 1 % suggests a low likelihood of exploitation in the wild. The plugin logs data only when a migration or backup operation is performed, so an attacker would need to trigger such an operation—likely requiring administrative privileges or the ability to execute plugin code. If the log files are stored in a location accessible via HTTP, an attacker could read them directly; otherwise, the threat is limited to insider or compromised accounts. The vulnerability is not currently listed in the CISA KEV catalog.