CVE-2026-14503 is a sensitive information exposure vulnerability in the pCloud WP Backup WordPress plugin affecting all versions up to and including 2.0.3. Authenticated attackers with subscriber-level privileges can invoke the wp2pcl_ajax_process_request_inner function to force the generation of a full-site backup archive. This archive is stored in the plugin's publicly accessible tmp/ directory at a predictable URL, allowing unauthenticated users to download it. The backup contains critical files such as wp-config.php (database credentials), WordPress secret salts, and the full PHP source tree, exposing sensitive data to unauthorized actors. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation guidance is currently available.

An attacker with subscriber-level access can cause the plugin to create a backup archive containing sensitive configuration and source code files. Because the backup is stored in an unprotected, publicly accessible directory at a predictable URL, unauthenticated users can retrieve this archive, leading to exposure of database credentials, secret salts, and the full PHP source code. This exposure can compromise the confidentiality of the WordPress site and potentially facilitate further attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for unusual backup creation activity. Consider removing or disabling the pCloud WP Backup plugin if subscriber-level users cannot be fully trusted. Avoid exposing the plugin's tmp/ directory publicly by applying web server access controls if feasible.