CVE-2026-14503: pCloud WP Backup Information Disclosure

CVE-2026-14503 Overview

CVE-2026-14503 is a sensitive information exposure vulnerability in the pCloud WP Backup plugin for WordPress. The flaw affects all versions up to and including 2.0.3 and resides in the wp2pcl_ajax_process_request_inner handler. Authenticated attackers with subscriber-level access or above can force generation of a full-site backup archive. The archive is written to the plugin's unprotected tmp/ directory at a predictable URL. Any unauthenticated visitor can then download the archive, which exposes wp-config.php database credentials, WordPress secret salts, and the complete PHP source tree. The weakness is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
A subscriber-level account can trigger creation of a downloadable site backup that leaks database credentials, secret salts, and full source code to unauthenticated visitors.

Affected Products

pCloud WP Backup plugin for WordPress, all versions through 2.0.3
WordPress sites where the plugin is installed and active
Sites permitting subscriber-level registration are at increased exposure

Discovery Timeline

2026-07-17 - CVE-2026-14503 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-14503

Vulnerability Analysis

The pCloud WP Backup plugin registers an AJAX action that dispatches into wp2pcl_ajax_process_request_inner. This function initiates a full-site backup routine implemented in class-wp2pcloudfilebackup.php. The routine collects WordPress core files, plugin and theme source, uploads, and the wp-config.php file, then archives them into the plugin's tmp/ directory inside wp-content/plugins/pcloud-wp-backup/.

Access control on the AJAX endpoint checks only that a user is authenticated. It does not restrict callers to administrators or verify a capability such as manage_options. A subscriber account, which WordPress allows any registered user to hold, satisfies the check. The backup archive is written under the web-accessible plugin path and served by the default WordPress web server configuration.

Root Cause

The root cause is missing authorization on a privileged AJAX action, combined with insecure storage of the resulting archive. The handler does not gate execution behind an administrative capability, and the tmp/ output directory lacks an .htaccess, index.php, or equivalent control that would block direct HTTP access. The archive filename is predictable, so an attacker who triggers the backup can construct the download URL directly.

Attack Vector

An attacker registers or compromises a subscriber account on a target site running an affected version. The attacker sends an authenticated AJAX request invoking the vulnerable action to force backup generation. Once the archive is written to the plugin's tmp/ directory, the attacker requests it over HTTP without authentication. Extracted contents include database credentials in wp-config.php, AUTH_KEY and related salts, and the full PHP source, enabling further attacks such as database access, session forgery, and targeted secondary exploitation.

Refer to the Wordfence Vulnerability Report and the plugin source at class-wp2pcloudfilebackup.php line 111 for the vulnerable code paths.

Detection Methods for CVE-2026-14503

Indicators of Compromise

Files present under wp-content/plugins/pcloud-wp-backup/tmp/, particularly archive files such as .zip or .tar created outside a scheduled backup window
HTTP GET requests to URLs under the plugin's tmp/ path from external IPs
Authenticated AJAX POST requests to admin-ajax.php with the wp2pcl_ajax_process_request_inner action originating from subscriber accounts
New or recently created subscriber accounts followed shortly by AJAX backup activity

Detection Strategies

Inspect web server access logs for admin-ajax.php requests carrying the wp2pcl_ajax_process_request_inner action and correlate the caller's user role
Alert on any HTTP request to files inside wp-content/plugins/pcloud-wp-backup/tmp/ from outside trusted management IP ranges
Monitor WordPress user registrations for spikes preceding AJAX backup activity

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized log platform and build rules for the vulnerable action name
Track file creation events in the plugin directory using file integrity monitoring
Review subscriber-role activity for AJAX calls not typical of that privilege level

How to Mitigate CVE-2026-14503

Immediate Actions Required

Update the pCloud WP Backup plugin to a fixed release beyond version 2.0.3 once available, or deactivate and remove the plugin
Delete any existing archives under wp-content/plugins/pcloud-wp-backup/tmp/ and rotate database credentials and WordPress secret salts if exposure is suspected
Disable open user registration or restrict the default role to reduce the pool of accounts that can reach the vulnerable action
Audit subscriber-level accounts and remove those not tied to legitimate users

Patch Information

Refer to the plugin repository change set 3597399 for the vendor commit associated with this issue. Confirm the installed plugin version is later than 2.0.3 and validate that the AJAX handler enforces an administrative capability check.

Workarounds

Deny web access to the plugin's tmp/ directory by placing an .htaccess rule or equivalent web server configuration that returns 403 for all requests
Block the wp2pcl_ajax_process_request_inner AJAX action at the web application firewall until a patched version is deployed
Rotate wp-config.php database credentials and regenerate AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY salts after remediation

bash

# Apache: block direct HTTP access to the plugin tmp directory
# Place this file at wp-content/plugins/pcloud-wp-backup/tmp/.htaccess
<IfModule mod_authz_core.c>
    Require all denied
</IfModule>
<IfModule !mod_authz_core.c>
    Order allow,deny
    Deny from all
</IfModule>