CVE-2024-12330 describes a vulnerability in the WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress, affecting all versions up to 7.3. The issue arises because backup files are publicly accessible, enabling unauthenticated attackers to retrieve sensitive data stored in these backups. This exposure is classified under CWE-530, which involves exposure of backup files to unauthorized entities. The vulnerability has a CVSS 3.1 score of 7.5, reflecting a high risk due to network attack vector, no required privileges or user interaction, and high confidentiality impact.

An attacker can access backup files without authentication, potentially extracting all sensitive information stored in the WordPress database backups. This compromises confidentiality but does not affect integrity or availability. The exposure of sensitive data can lead to further attacks or data breaches depending on the contents of the backup files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to backup files by configuring web server permissions or using security plugins to prevent public access to backup directories. Monitor for updates from the plugin vendor and apply patches promptly once released.