CVE-2026-48965

Summary dbcve.org

XCloner WordPress backup plugin versions 4.8.6 and prior contain a vulnerability allowing unauthorized access to subscriber-sensitive data. The exposure likely involves improper access controls on backup files or sensitive information stored within the plugin's data structures, potentially exposing user credentials, personal information, or backup content to unauthorized subscribers.

Mitigation

Update XCloner plugin to a version beyond 4.8.6. If no patch is available, consider disabling the plugin until a fix is released, or implement additional access controls at the web server level to restrict sensitive plugin directories.