The pCloud WP Backup plugin for WordPress contains an unauthenticated Cross‑Site Request Forgery vulnerability in all versions up to 2.0.2. The flaw arises because the plugin does not validate requests that come from external domains, allowing an attacker to embed a forged request on a third‑party site and have the target WordPress site process it as if it were issued by an authenticated user. State‑changing operations such as initiating backups or modifying configuration are inferred from the plugin’s administrative endpoints, and a successful exploitation could result in unauthorized data transfer or configuration changes.

Any WordPress site that has installed the pCloud WP Backup plugin version 2.0.2 or earlier is affected. The vulnerability applies regardless of the user’s authentication state, meaning an unauthenticated visitor could trigger the flaw if they can lure a legitimate user or exploit the site directly.

The CVSS base score of 7.1 classifies the vulnerability as moderate to high risk. The EPSS score of <1% indicates that exploitation is unlikely in the near term, and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the flaw by using a CSRF technique from any external domain, sending forged requests that the WordPress site will process because the plugin lacks CSRF safeguards; this attack vector is inferred from the nature of CSRF.