The vulnerability arises from the wp2pcl_ajax_process_request_inner handler that fails to enforce proper authorization on the start_backup AJAX call. In effect, any authenticated user with subscriber-level or higher privileges can request a full‑site backup. The backup archive, written to the plugin’s unprotected tmp/ directory, becomes reachable via a predictable URL and contains wp-config.php, database credentials, secret salts, and the entire PHP codebase. This makes the affected site’s confidential configuration data and source code discoverable by unauthenticated visitors, compromising the confidentiality of the site’s settings and code.

The flaw affects the ploudapp pCloud WP Backup plugin for WordPress on all versions up to and including 2.0.3. Users running this plugin, regardless of theme or other installed plugins, are potentially impacted. The issue only exists for WordPress sites that have the plugin installed and where the wp-config.php file and source tree are accessible after the backup is generated.

The CVSS base score of 6.5 indicates a medium severity vulnerability, but the exploitation is relatively easy for an attacker who can authenticate as at least a subscriber. The EPSS score of less than 1% suggests that exploitation is unlikely at present, possibly due to the need for a site‑specific authenticated account. The vulnerability is not listed in CISA KEV, meaning there is no record of known exploitation. An attacker can trigger the backup through the AJAX endpoint, forcing the protected tmp/ folder to be exposed to the public and retrieve the generated backup file, thus exfiltrating sensitive configuration and source code. The attack does not require additional privileges beyond subscriber‑level access and the resulting data dump can lead to a full compromise of the site’s secrets.