The SafeSnap – Verified WordPress Backup & Restore plugin versions 2.1.2 and earlier contain a defect that allows unauthenticated users to access confidential information, such as backup files or site credentials, through exposed plugin endpoints. The vulnerability stems from insufficient validation of request parameters, enabling the disclosure of sensitive data without requiring any login or authentication tokens. Consequently, attackers can retrieve valuable data that could be leveraged for further compromise or data theft.

WordPress sites utilizing the SafeSnap – Verified WordPress Backup & Restore plugin by Pluginjoy, version 2.1.2 or older. The flaw affects all installations where the plugin remains at or below the specified version, regardless of other site configurations.

The CVSS score of 7.5 indicates a high severity of the flaw, and an EPSS score of < 1% is reported, which suggests low but nonzero likelihood of exploitation. The lack of authentication requirement makes exploitation likely if the vulnerable plugin is publicly accessible. The vulnerability is not currently listed in CISA KEV, indicating no confirmed large-scale exploitation yet, but the potential for data leakage remains significant for all impacted sites. An attacker would typically target the exposed WordPress plugin URLs through a web browser or automated scraping, gaining the exposed data without additional privileges.