The WebToffee WP Backup and Migration plugin for WordPress contains a missing authorization (CWE-862) vulnerability in the wp_mgdp_populate_popup function in all versions up to 1.4.8. This flaw permits any authenticated user with subscriber or higher privileges to invoke this function without proper capability checks, enabling unauthorized access to plugin log files. Furthermore, the filename parameter is user-controlled and insufficiently sanitized, which can be exploited to read arbitrary log files on the server's file system. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but resulting in limited confidentiality impact.

An attacker with subscriber-level access or above can exploit this vulnerability to read log files maintained by the plugin, potentially exposing sensitive information contained in those logs. The ability to specify arbitrary filenames without proper sanitization increases the risk by allowing access to other log files on the server, which may contain sensitive data. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor plugin updates from WebToffee. Avoid granting unnecessary privileges to users and consider disabling or removing the plugin if it is not essential.