CVE-2026-81804

CVE-2026-81804 is an unauthenticated sensitive data exposure flaw (CWE-201) in the ZHBackup – Backup, Restore & Migration plugin for WordPress, affecting all versions up to and including 2.4.2. Because the vulnerable functionality requires no privileges, any remote attacker can trigger it simply by sending unauthenticated requests to the affected plugin endpoint, with no account, credentials, or user interaction needed. Successful abuse results in disclosure of sensitive information handled by the plugin — which, for a backup and migration tool, may include site or backup-related data — with a high confidentiality impact only and no effect on integrity or availability per the CVSS vector. Any WordPress site running ZHBackup version 2.4.2 or earlier is affected. There is no public proof-of-concept, the flaw is not listed in CISA's KEV catalog, and no exploitation in the wild has been confirmed.

What to do: Update ZHBackup to the first release newer than 2.4.2 as soon as a patched version is published (check the WordPress plugin directory or the vendor's changelog; no fixed version number is specified in the disclosure data). Until patched, restrict unauthenticated access to the plugin's routes/endpoints where possible and review whether any generated backups or exposed data could have been retrieved. Continue monitoring the plugin page for the security release.