CVE-2026-57757: Unauthenticated CSRF in pCloud WP Backup ≤2.0.2 – Backup Security Risk

Technical summary

CVE-2026-57757 is a CSRF vulnerability (CWE-352) in pCloud WP Backup affecting version 2.0.2 and earlier. The plugin fails to implement adequate anti-CSRF protections, allowing an unauthenticated attacker to forge requests that execute privileged actions when a WordPress administrator is logged in. The vulnerability carries a CVSS v3.1 score of 7.1 (HIGH) with network-based attack vector, low complexity, no privilege requirement, and user interaction needed. The attack can result in high confidentiality impact and limited integrity impact, but does not affect availability. The vector string reflects CWE-352 (Cross-Site Request Forgery) as the root cause.

Business impact

Organizations relying on pCloud WP Backup for WordPress data protection face operational risk if an attacker exploits this CSRF to modify backup settings, disable backups, redirect backup storage to attacker-controlled accounts, or alter recovery policies. The impact extends beyond individual site operators to managed service providers and agencies managing multiple client WordPress installations. Remediation requires immediate plugin updates to prevent silent compromise of backup integrity or availability, which could complicate incident response and data recovery if the primary system is compromised.

Affected systems

The vulnerability affects pCloud WP Backup plugin versions 2.0.2 and earlier. Any WordPress installation with the plugin active and at least one administrator user is at risk. The attack requires an administrator to visit a malicious page while logged into WordPress, making public-facing WordPress admin dashboards and internal WordPress networks both potential attack surfaces.

Exploitability

Exploitation requires user interaction (a logged-in administrator must visit an attacker-controlled or compromised webpage), but is otherwise straightforward to execute. An attacker does not need valid credentials or special network positioning. The low complexity and network-based attack vector mean exploitation can be automated at scale via email campaigns or watering-hole tactics targeting WordPress administrators. The CVSS score of 7.1 reflects this moderate-to-high exploitability profile, though no public exploit or proof-of-concept has been tracked in the Known Exploited Vulnerabilities catalog.

Remediation

Update pCloud WP Backup to a patched version released after 2.0.2. Verify the specific patch version against the official pCloud or WordPress.org plugin repository advisory. In the interim, restrict access to WordPress admin interfaces using IP whitelisting, require multi-factor authentication for administrators, and educate administrators to avoid clicking unfamiliar links while logged into WordPress. Consider temporarily disabling the plugin if a patched version is not immediately available and you cannot apply preventive controls.

Patch guidance

Check the official pCloud WP Backup repository on WordPress.org or contact pCloud support for the availability of version 2.0.3 or later. Patches should address CSRF token validation and implement proper nonce generation for all state-changing actions in the plugin. Test patches in a staging environment before deploying to production to ensure backup operations remain functional. If no patch is released, consider switching to an alternative backup solution with active security maintenance.

Detection guidance

Monitor WordPress admin logs for suspicious backup configuration changes initiated by administrators, especially outside normal change windows. Look for unexpected modifications to pCloud API credentials, backup schedules, or storage destinations. Review HTTP referrer logs and access patterns to the WordPress admin panel for evidence of CSRF attacks (requests from external domains). Implement plugin-level logging if available. Conduct a review of recent backup configurations and restore points to verify integrity and ensure no attacker-controlled cloud credentials are in use.

Why prioritize this

Prioritize this vulnerability because it combines HIGH severity, ease of exploitation via social engineering, and direct impact on a critical infrastructure component—backup systems. Backup compromise can undermine incident response and business continuity. Although no active exploitation has been reported in the KEV catalog, the low barrier to weaponization and the prevalence of WordPress make rapid patching prudent. Organizations managing backup systems for multiple sites should prioritize this as a preventive security action.

Risk score, explained

The CVSS v3.1 score of 7.1 reflects a HIGH-severity vulnerability with network-based attack surface, low complexity, no authentication requirement, and limited user interaction needed. The high confidentiality impact suggests attackers can read backup metadata or configs; the limited integrity impact means configuration tampering is the primary concern. Availability is not impacted, lowering the score below critical range. The absence of KEV status and public exploits does not reduce the intrinsic risk—organizations should not delay patching pending weaponization evidence.

Frequently asked questions