The Database Toolset plugin for WordPress (neoslab) versions up to 1.8.4 exposes sensitive information due to backup files being stored in publicly accessible locations. This exposure (CWE-200) enables unauthenticated attackers to extract sensitive data from these backups. An index file is present, meaning an attacker must perform a brute force attack to find the backup files. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

An unauthenticated attacker can potentially access sensitive data contained in database backup files stored publicly by the plugin. This compromises confidentiality but does not affect data integrity or availability. The presence of an index file requires a brute force approach, increasing attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict public access to backup file locations and remove any publicly accessible backup files to prevent unauthorized data exposure.