CVE-2026-48965

Vulnerability

XCloner Backup and Restore plugin for WordPress versions up to and including 4.8.6 exposes subscriber-level sensitive data due to insufficient access controls. The vulnerability is present in the plugin's data handling routines that are reachable by authenticated users with subscriber privileges.

Exploitation

An attacker with a valid subscriber account on a WordPress site using XCloner 4.8.6 or earlier can view sensitive information that is normally restricted. The attack does not require special network position or additional privileges beyond a subscriber role.

Impact

Successful exploitation results in the exposure of sensitive subscriber data, including information that could be used to further compromise the system. This is a confidentiality breach affecting subscriber data integrity and could enable broader attacks.

Mitigation

The vulnerability is fixed in XCloner version 4.8.7. Users are advised to update immediately. If updating is not possible, Patchstack provides a mitigation rule to block attacks until the update is applied. The vulnerability is listed as moderately dangerous and expected to be exploited in mass campaigns [1].