The vulnerability is an unauthenticated sensitive data exposure in the Snapshotify All-in-One Backup & Restore & Migrate plugin for WordPress. Versions 1.3.2 and earlier are affected. An attacker who can send requests to the affected plugin can retrieve sensitive information that should be protected, such as backup files, configuration data, or authentication credentials. This flaw is classified as a CWE‑201 Information Exposure vulnerability.

The affected systems are WordPress sites that have the DaftPlug Snapshotify plugin installed between the initial release through 1.3.2. The plugin is provided by DaftPlug and is found in WordPress as "Snapshotify – All-in-One Backup & Restore & Migrate." Site administrators should check the installed version and confirm that it is 1.3.2 or older.

The CVSS score of 7.5 indicates high severity, and the EPSS score of 0.00316 (less than 1%) indicates a low exploitation probability. However, because the vulnerability is unauthenticated, any visitor could potentially access sensitive data. The issue is not listed in the CISA KEV catalog, but the impact on confidentiality is significant. Attackers could collect confidential data, violating privacy or compliance requirements.