A missing authorization flaw in the FastDup WordPress plugin allows authenticated attackers with contributor access to create and download full site backups, posing a high risk of sensitive data exposure.

The vulnerability is caused by a missing capability check on REST API endpoints, specifically within the PackageApi component. This flaw allows attackers with contributor-level privileges or higher to trigger unauthorized backup operations and retrieve sensitive configuration files and database exports.

Successful exploitation results in the exposure of an entire WordPress installation, including database contents and configuration files. Given the CVSS score of 8.8, this vulnerability presents a significant risk of data breach and intellectual property loss. Unauthorized access to site credentials and database contents can lead to full site compromise and long term reputational damage.

Immediate Action: Update the FastDup plugin to the latest version, ensuring the patch provided in changeset 3449530 is applied.

Proactive Monitoring: Monitor WordPress REST API request logs for unusual calls to backup or package generation endpoints, particularly those originating from user accounts with contributor-level permissions.

Compensating Controls: Deploy a Web Application Firewall to restrict access to sensitive REST API endpoints and disable the plugin if it is not strictly required for ongoing site management.

Public Exploit Available: No

Given the severity of this vulnerability and the potential for full site data exfiltration, administrators should verify their current version of FastDup immediately. If running version 2.7.1 or older, apply the update provided by the vendor to remediate the authorization flaw and prevent unauthorized access to sensitive backup archives.