CVE-2026-42630

Summary

The Web Plura Backup & Restore Manager plugin exposes sensitive data to unauthenticated users through a vulnerable endpoint in versions up to 0.2.25. This allows attackers to access backup files, configuration details, and potentially other sensitive information without requiring any authentication.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability affects an unauthenticated endpoint that directly exposes sensitive data.

Blast radius

The impact could be significant in environments where this plugin is deployed, potentially exposing database backups, configuration files, and other sensitive data to attackers who can access the vulnerable endpoint.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.2.26 or later to remediate this sensitive data exposure vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.