The vulnerability is a missing authorization flaw that allows an attacker to access or manipulate data protected by the pCloud Backup plugin’s access controls. An attacker that can reach the plugin’s administrative endpoints may read backup files, upload new ones, or modify configurations, undermining the confidentiality and integrity of the site’s backup data. The weakness is described as a Missing Authorization (CWE‑862) issue, meaning the plugin does not properly verify that a user is permitted to perform certain actions.

This issue impacts the josselynj WordPress pCloud Backup plugin version 1.0.1 and earlier. WordPress sites that have any of those versions installed are affected; newer releases are not. The vulnerability does not affect other plugins or the core WordPress software.

The CVSS score is 4.3, indicating a moderate severity. The EPSS score of less than 1 % shows that the likelihood of exploitation today is very low, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is a missing authorization check, an attacker only needs access to the website to send a request to the plugin’s protected endpoints; no special privileges or remote code execution are required. The risk remains manageable as long as the plugin is patched or removed.