CVE-2026-42419

Received Received - Intake

Unauthenticated Sensitive Data Exposure in Swish Migrate

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: Patchstack

Description

Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-10

Generated

2026-10-11

AI Q&A

2026-10-11

EPSS Evaluated

N/A

NVD

CVE-2026-42419

EUVD

EUVD-2026-96543

Affected Vendors & Products

Vendor	Product	Version / Range
SwishFolio	Swish	Migrate and Backup n/a

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-42419 is an unauthenticated sensitive data exposure vulnerability in the Swish Migrate and Backup WordPress plugin versions 1.4.0 and below. It allows unauthorized parties to access private information such as passwords, emails, or payment details without authentication.

Impact Analysis

This vulnerability can lead to theft of sensitive data like passwords, emails, or payment details by attackers. It poses a moderate risk with a CVSS score of 5.9 and may be exploited in mass campaigns targeting thousands of websites.

Mitigation Strategies

Immediately update the Swish Migrate and Backup plugin to the latest version if available. If no patch exists, contact your hosting provider or a web developer for assistance. Disable the plugin temporarily if updates are not possible to prevent data exposure.

Hi! I’m here to help you understand CVE-2026-42419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70