Unprivileged users can invoke functions in the WordPress Backup & Migration plugin without authentication, allowing them to execute operations normally reserved for administrators. The vulnerability is a classic broken access control flaw, identified as CWE-862, and could enable an attacker to retrieve backup files or perform migration actions which may expose sensitive content or configuration settings.

All WordPress sites running WebToffee's WordPress Backup & Migration plugin version 1.6.0 or earlier are affected. The issue is not limited to specific WordPress core versions, but any installation that has not updated the plugin to 1.6.1 or newer.

The CVSS score of 7.5 indicates a high severity, and although the EPSS score is not available, the absence from the CISA KEV catalog suggests no widespread exploitation has been observed yet. The likely attack vector is remote over the web, as the insecure endpoints can be accessed by anyone who can reach the site's URL. An attacker could exploit this to read or download backup data, effectively compromising confidentiality.