CVE-2024-13807 is a vulnerability in the Xagio SEO – AI Powered SEO WordPress plugin affecting all versions up to 7.1.0.5. The issue arises from weak filename structures and insufficient directory protections in the plugin's backup functionality, which allows unauthenticated attackers to download backup files containing sensitive data such as the entire database and site files. This exposure of sensitive information is categorized under CWE-200. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The plugin is not a cloud service, and no official patch or vendor advisory detailing remediation is currently available.

Successful exploitation allows unauthenticated attackers to access sensitive information including the entire database and site files of a WordPress site using the vulnerable Xagio SEO plugin. This exposure can lead to data leakage and potential further compromise depending on the contents of the backups. The vulnerability does not impact integrity or availability directly but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the backup functionality of the plugin or restricting access to backup directories via web server configuration to prevent unauthorized access. Monitoring for updates from the vendor is recommended to apply any forthcoming patches promptly.