CVE-2026-41562: WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Q: Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. The network attack vector and low attack complexity indicate it can be targeted remotely without special conditions stated in the available data.

Q: What is the likely impact if exploitation succeeds?

The vulnerability exposes sensitive data. The supplied CVSS vector indicates high confidentiality impact, with no integrity or availability impact identified.

Q: Which installations are affected?

Norvis Backup versions up to and including 1.1.0 are affected. The available data does not state whether any particular plugin configuration is required.

Q: How urgent is remediation?

The issue is rated high severity with a CVSS score of 7.5. Because exploitation requires no authentication or user interaction, affected internet-accessible WordPress sites should be prioritized for remediation.

Published Oct 6, 2026

Updated

Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.

Affected Software

1 affected component

Norvis Norvis Backup<=1.1.0

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The issue is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. The network attack vector and low attack complexity indicate it can be targeted remotely without special conditions stated in the available data.

What is the likely impact if exploitation succeeds?

The vulnerability exposes sensitive data. The supplied CVSS vector indicates high confidentiality impact, with no integrity or availability impact identified.

Which installations are affected?

Norvis Backup versions up to and including 1.1.0 are affected. The available data does not state whether any particular plugin configuration is required.

How urgent is remediation?

The issue is rated high severity with a CVSS score of 7.5. Because exploitation requires no authentication or user interaction, affected internet-accessible WordPress sites should be prioritized for remediation.

CVE-2026-41562: WordPress Norvis Backup plugin <= 1.1.0 - Sensitive Data Exposure vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which installations are affected?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact if exploitation succeeds?

Which installations are affected?

How urgent is remediation?