{
 "id": "WPSEC-2026-0684",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0684/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0684/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0684/index.md",
 "title": "WP Rollback <= 3.1.2 - Unauthenticated Sensitive Information Exposure via Predictable Backup Archive Paths",
 "description": "The WP Rollback plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 3.0.0 up to, and including, 3.1.2. Backup archives of premium (non-WordPress.org) plugins and themes, created when they are updated, were stored in the uploads directory under a fixed folder name with file names built from the plugin or theme slug and version, protected only by an .htaccess file. This makes it possible for unauthenticated attackers to download these backup archives on web servers that do not process .htaccess files, such as Nginx, exposing the files of the backed-up premium plugins and themes.",
 "plugin": {
  "slug": "wp-rollback",
  "name": "WP Rollback",
  "full_name": "WP Rollback – Rollback Plugins and Themes",
  "wordpress_org": "https://wordpress.org/plugins/wp-rollback/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-rollback/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-rollback"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.0.0",
    "from_inclusive": true,
    "to": "3.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.0.0 before 3.2.0"
  ]
 },
 "introduced_in": "3.0.0",
 "fixed_in": "3.2.0",
 "remediation": "Update to 3.2.0 or later.",
 "fix_released": "2026-10-08T05:09:58+00:00",
 "published": "2026-10-09T05:41:36+00:00",
 "updated": "2026-10-08T07:41:11.541962+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0684/",
  "https://plugins.svn.wordpress.org/wp-rollback/tags/3.2.0/",
  "https://wordpress.org/plugins/wp-rollback/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-rollback",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-09"
 }
}