The vulnerability CVE-2024-13911 affects the sminozzi WordPress plugin 'Database Backup and Table Integrity Check with Automated Scheduling' through the /dashboard/backup.php endpoint. Authenticated attackers with Administrator or higher privileges can exploit this flaw to retrieve sensitive data, notably full database credentials. This exposure is due to improper protection of sensitive information, categorized under CWE-200. The CVSS 3.1 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or remediation details have been provided by the vendor as of the published date.

An attacker with Administrator-level access can extract sensitive information such as full database credentials from the vulnerable plugin. This can lead to further compromise of the WordPress site and its underlying database, potentially resulting in data theft, data manipulation, or denial of service. The vulnerability affects confidentiality, integrity, and availability of the system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Administrator-level access to trusted users only and monitor for suspicious activity. Avoid exposing the /dashboard/backup.php endpoint unnecessarily. Follow vendor updates closely for any forthcoming patches or mitigations.