CVE-2026-97197

Summary

A WordPress plugin with unauthenticated broken access control allows attackers to bypass authentication and access backup files without any credentials. This vulnerability affects versions up to 1.6.0 and can lead to sensitive data exposure.

Exploitability

Exploitation is straightforward with no prerequisites, as the vulnerability allows full access to backup files from any unauthenticated user.

Blast radius

The impact could be significant as attackers can access complete WordPress backups containing database credentials, user information, and potentially other sensitive files.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.6.1 or later which includes the access control fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.