SiteVault – Backup, Restore, Migration & Cloning versions up to 1.5.17 contain an unauthenticated sensitive data exposure flaw (CWE‑201). The defect allows a remote attacker to read protected data stored or processed by the plugin, such as backup archives or configuration files, without needing authentication. The vulnerability directly compromises confidentiality for anyone who can reach the plugin’s exposed endpoints.

The flaw affects any installation of Royal Plugins’ SiteVault plugin on WordPress sites running version 1.5.17 or earlier. Sites are vulnerable until the plugin is upgraded to 1.5.18 or later, which includes the fix.

The CVSS score of 7.5 indicates high severity, but the EPSS score of < 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The flaw is unauthenticated and exploitable via standard HTTP requests to the plugin’s exposed REST API endpoints. Based on the description, the likely attack vector is remote web requests from any network actor without authentication, potentially allowing a data leak if the system is exposed to the internet.