The pCloud WP Backup plugin for WordPress contains an unauthenticated Cross‑Site Request Forgery flaw in all releases up to and including 2.0.2, representing a CSRF weakness (CWE‑352). The description indicates that the plugin’s administrative endpoints appear to lack CSRF protection, allowing a visitor to send a forged request that the site will process as if it were submitted by an authorized user. It is inferred that such a request could trigger privileged actions, such as initiating a backup or altering backup settings, although the CVE description does not detail which specific actions are affected.

Any WordPress site that has installed the pCloud WP Backup plugin version 2.0.2 or earlier is affected. The vulnerability appears to apply regardless of the user’s role or authentication state, as the lack of CSRF protection is present on administrative paths within the plugin.

The CVSS score of 7.1 indicates moderate‑to‑high risk. The EPSS score of <1% suggests that exploitation is unlikely in the short term, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferable as a cross‑site request forgery, whereby a malicious actor can embed a link or form on an external site to cause the target site to. Successful exploitation would allow an attacker to perform any operation that the plugin’s administrative interface permits, potentially leading to data loss or service disruption.