Regular user (created using wp-login.php?action=register) can run backup functionality:
Proof of Concept:
Login as regular user then queue backup.
After that you can start scheduled backup (you must use this link few times because backup has few steps):
You can download backup using Disclosure of Potentially Sensitive Information
- 20-10-2014: Discovered
- 15-11-2014: Vendor notified
- 18-11-2014: Version 1.9.1 released, issue resolved