Unauthenticated sensitive data exposure exists in the WordPress Web Plura Backup & Restore Manager plugin versions 0.2.25 and earlier. The plugin’s endpoints expose configuration data, backup files, or logs without enforcing authentication. A remote user can retrieve this sensitive information by accessing these URLs, potentially exposing database credentials, site configuration, or other confidential details that could be leveraged for further compromise.

WordPress sites that have installed the Web Plura Backup & Restore Manager plugin version 0.2.25 or older are vulnerable. The advisory does not list other versions or product variants, so any installation of the plugin at these versions is at risk.

The vulnerability has a CVSS score of 7.5, indicating high severity. No EPSS score is available, so the likelihood of exploitation cannot be quantified. The issue is not listed in CISA’s KEV catalogue. Because authentication is not required, an attacker can exploit the exposed plugin routes from any network location that can reach the site, making the threat immediate and straightforward.