Unauthenticated Sensitive Data Exposure exists in the WordPress Trinity Backup plugin up to version 2.0.9. The vulnerability stems from a missing authentication check that allows anyone to request sensitive backup files or configuration data. If accessed, an attacker could read potentially confidential information such as database dumps, configuration files, or other data stored by the plugin, which could lead to further compromise of the site.

Kingaddons Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups plugin for WordPress, versions 2.0.9 and earlier are impacted. The fix begins with version 2.0.10, which removes the unauthenticated access path.

The CVSS score of 7.5 indicates a high severity vulnerability. EPSS data is not available, so the likelihood of exploitation is uncertain, but the lack of an authentication barrier makes exploitation straightforward. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed active exploits yet. The likely attack vector is via direct HTTP requests to the plugin’s endpoints that serve backup content, and because the check is absent, any user on the network or the public internet could exploit it if the site is publicly reachable.