Missing authorization allows an attacker without proper permissions to perform backup and restore actions on a WordPress site. The plugin exposes endpoints that can be accessed when logged in, but role checks are ineffective, enabling retrieval of full database backups that reveal credentials, user data and configuration. This flaw represents a classic access‑control failure, identified as CWE-862.

The vulnerability affects the WordPress plugin 1-Click Backup & Restore Database by Tim Nguyen, distributed under the Sunbytes name. All releases through 1.0.3 are impacted. Sites that still host this plugin and permit broad administrator access are at risk.

The CVSS score of 5.4 demonstrates moderate severity, while the EPSS score of <1% indicates a very low exploitation probability. The issue is not listed in the CISA KEV catalog. An attacker could exploit it remotely by sending crafted HTTP requests to the plugin’s backup endpoints, provided that authentication or privilege checks cannot be enforced. Because the functionality is publicly reachable within a WordPress installation, an active user or even a low‑privileged site visitor may be able to trigger the vulnerability.