CVE-2026-14503

Name of the Vulnerable Software and Affected Versions pCloud WP Backup versions prior to 2.0.4

Description An issue exists in the wp2pcl ajax process request inner function that allows authenticated users with subscriber-level access or higher to force the generation of a full-site backup archive. This archive is stored in a publicly accessible tmp/ directory at a predictable URL, enabling unauthenticated visitors to access sensitive data. The exposed information includes the wp-config.php file containing database credentials, WordPress secret salts, and the entire PHP source tree.

Recommendations Update pCloud WP Backup to version 2.0.4 or later.