The FastDup – Fastest WordPress Migration & Duplicator plugin has a missing capability check on several REST API endpoints. Because the endpoints do not verify that the requesting user has the required privileges, any authenticated user with Contributor-level access or higher can trigger a full‑site backup archive to be created and subsequently download it. The backup archive contains the entire WordPress installation, including database dumps and configuration files. The vulnerability does not grant code execution or privilege escalation; it simply allows an attacker to exfiltrate confidential site data.

All installations of FastDup – Fastest WordPress Migration & Duplicator up to and including version 2.7.1 are affected. The flaw exists in any instance of the plugin that exposes the vulnerable REST API endpoints for backup creation and download.

The assigned CVSS score of 8.8 classifies this as a high‑severity flaw. The EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only authenticated access, which an attacker with Contributor‑level permissions can obtain. Because the flaw results in data disclosure rather than system compromise, the threat domain is limited to confidentiality loss.