Untrusted users can access, read, or modify backup data stored by the WXD Backup Lite plugin whenever they are not authenticated, because the plugin does not enforce proper authorization on its endpoints. This represents a broken access control weakness (CWE-862) that could lead to data exposure or website sabotage through unauthorized backup access.

WordPress installations that use wxdlabs WXD Backup Lite version 1.0.2 or earlier are affected. The vulnerability applies to all sites that have not upgraded past the vulnerable release.

The CVSS score of 7.5 classifies the issue as high severity. The EPSS score is <1%, indicating a low predicted exploitation probability, though the lack of authentication requirements still suggests exploitation could occur. The vulnerability is not listed in CISA’s KEV catalog, but based on the description, the likely attack path involves sending crafted HTTP requests to the plugin’s endpoints; this path appears straightforward and requires no special privilege.