Unauthenticated Sensitive Data Exposure is present in the Museder RestoreOne WordPress plugin up to version 2.7.276. A remote user can retrieve confidential data stored by the plugin without needing authentication. This flaw falls under the CWE‑201 weakness for sensitive data exposure, potentially leaking user credentials, backups, or configuration details.

WordPress sites using the Museder RestoreOne plugin versions 2.7.276 or earlier, released by Adrian Lin. The vulnerability affects all installations that have not upgraded beyond 2.7.276.

The CVSS score of 7.5 denotes a high severity. An EPSS score of < 1% indicates a very low, but non‑zero, likelihood of exploitation, but the lack of authentication requirements means an attacker could exploit the flaw simply by accessing the website’s URLs. The vulnerability is not currently listed in CISA’s KEV catalog, but its impact on data confidentiality warrants immediate attention.