pCloud WP Backup <= 2.0.4 - Cross-Site Request Forgery

2026-07-02 00:00

R2D2

Strategic Overview

Status

Unpatched

Affected PluginpCloud WP Backup

Affected Version<= 2.0.4

CVSS4.3Medium

CVECVE-2026-57757

View all pCloud WP Backup vulnerabilities

Vulnerability Overview

The pCloud WP Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Technical Analysis

REMEDIATION: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement. --- IDENTIFIER: CWE-352 (Cross-Site Request Forgery (CSRF)) The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

External References

https://www.cve.org/CVERecord?id=CVE-2026-57757 https://www.wordfence.com/threat-intel/vulnerabilities/id/c272d8af-6ebd-44b2-bff2-fa94de2046c4

pCloud WP Backup <= 2.0.4 - Cross-Site Request Forgery (CVE-2026-57757)