CVE-2026-14503
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The pCloud WP Backup plugin for WordPress up to version 2.0.3 is vulnerable to sensitive information exposure via the wp2pcl_ajax_process_request_inner function. Authenticated attackers with subscriber-level access or higher can force the generation of a full-site backup archive written to a publicly accessible tmp/ directory, exposing database credentials, WordPress secret salts, and the complete PHP source tree.
Risk Assessment
The risk is that unauthenticated visitors can access the backup archive after it is generated, leading to the leakage of confidential data such as database passwords and encryption keys, enabling further attacks on the site.
Recommendation
It is recommended to immediately update the pCloud WP Backup plugin to the latest available version and remove any backup files from the tmp/ directory. Additionally, restrict access to the tmp/ directory using web server rules.
Other vulnerabilities in pCloud WP Backup
Original NVD description (English source)
The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pcl_ajax_process_request_inner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a full-site backup archive written to a publicly accessible directory, exposing wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The resulting archive is deposited in the plugin's unprotected tmp/ directory at a predictable URL, making the extracted data accessible to unauthenticated visitors once the backup is triggered.