CVE-2026-81804
Deferred Deferred - Pending Action

Unauthenticated Sensitive Data Exposure in ZHBackup

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: Patchstack

Description
Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration <= 2.4.2 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-81804
EUVD
EUVD-2026-75532

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zhbackup backup_restore_migration_plugin to 2.4.2 (inc)
zhbackup backup_restore_and_migration to 2.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-81804 is an unauthenticated sensitive data exposure vulnerability in the ZHBackup WordPress plugin versions 2.4.2 and below. It allows attackers to access sensitive information without authentication, potentially leading to further exploitation.

Detection Guidance

Check if the ZHBackup plugin version 2.4.2 or below is installed. Look for exposed sensitive data in plugin endpoints or logs. Use network scanning tools to identify unpatched versions.

Impact Analysis

This vulnerability can expose sensitive data, allowing attackers to access confidential information. It may lead to further attacks on the system, such as data breaches or unauthorized access to backups and migrations.

Compliance Impact

This vulnerability exposes sensitive data without authentication, which could lead to unauthorized access to personal or protected health information. This may violate GDPR (if personal data is exposed) or HIPAA (if health-related data is compromised), depending on the data processed by the plugin.

Mitigation Strategies

Update ZHBackup to version 2.4.3 or later immediately. If updating is not possible, seek help from a hosting provider or web developer. Enable auto-updates for the plugin if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81804. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart