pCloud WP Backup <= 2.0.3 Authenticated Arbitrary File Read via Missing Authorization (CVE-2026-14503)

Vulnerability Overview Vulnerability Name: pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read CVE ID: CVE-2026-14503 CVSS Score: 6.5 (Medium) Publication Date: July 16, 2026 Last Update Date: July 17, 2026 Researcher: Cvitaasans Impact Scope Affected Software: pCloud WP Backup Affected Versions: <= 2.0.3 Vulnerability Type: Sensitive Information Exposure to Unauthorized Users CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Remediation Fixed Version: Update to 2.0.4 or later Patch Version: 2.0.4 Vulnerability Description The pCloud WP Backup plugin contains a sensitive information exposure vulnerability in all versions of WordPress, including 2.0.3. Attackers can extract the complete website backup archive with subscriber-level access via the method, exposing database credentials, WordPress secret salts, and the complete PHP source code tree. The extracted archive is placed in the plugin's unprotected directory, making the extracted data accessible to unauthorized visitors once the backup is triggered. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Facebook Twitter LinkedIn Email Additional Information Software Type: Plugin Software Slug: pcloud-wp-backup Patched: Yes Recent Vulnerability: pCloud WP Backup <= 2.0.4 - Cross-Site Request Forgery (CVE-2026-57757, CVSS 4.3, Researcher R202, Date July 2, 2026) Disclaimer This record contains copyrighted material. Copyright 2012-2026 Defiant Inc. Copyright 1999-2026 The MITRE Corporation Contact Information For adding information or reporting errors, please contact: rfi-support@wordfence.com Business Hours 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Customer Support receives 24/7 support for 365 days a year with a 1-hour response time. Other Links Terms of Service Privacy Policy and Collection Notice Do Not Sell or Share My Personal Information Social Media X Facebook Instagram YouTube Products and Support Wordfence Free Wordfence Premium Wordfence Care Wordfence Response Wordfence CLI Wordfence Intelligence Wordfence Central News Blog News Vulnerability Advisories About About Wordfence Affiliate Program Careers Contact Security CVE Request Form Subscribe to Updates Sign up to receive news and updates from our team of experienced security professionals. By checking this box, I agree to the Terms of Service and Privacy Policy. Copyright © 2012-2026 Defiant Inc. All rights reserved Logos Wordfence Intelligence Wordfence

Goal Reached Thanks to every supporter — we hit 100%!

pCloud WP Backup <= 2.0.3 Authenticated Arbitrary File Read via Missing Authorization (CVE-2026-14503)

More from this source