The vulnerability allows an unauthenticated user to retrieve sensitive data from the Norvis Backup plugin, potentially exposing stored backup files or credentials. It is a classic data‑exposure weakness as described by CWE‑201, where information is disclosed without proper authorization controls.

The affected product is the Norvis Backup WordPress plugin for all users installing versions 1.1.0 or earlier. No vendor‑supplied patch is available for those older releases, leaving the expansion of credentials and backup material at risk.

With a CVSS score of 7.5, the flaw is considered high severity. The EPSS score of < 1% indicates a very low exploitation probability; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote and unauthenticated, such that any visitor to the site can trigger the offending behavior. The risk is elevated for sites that keep backups or credentials exposed without restrictive access controls.