Wordpress Alert: Backup restoration without authorization

What it looks like

A restoration action accepts a caller without administrative rights.

Why it matters

Site files and database contents may be replaced.

What to check

Restrict restore actions and review backup plugin advisories.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress backup guidance, WordPress roles and capabilities.