Executive brief
The Database Backup for WordPress plugin, which is used to create and manage backups of website data, contains a security flaw that allows unauthorized individuals to download the site's database. This could lead to the exposure of sensitive information, including user credentials and site configuration details. The risk is specifically present for websites using the WordPress Multisite feature on older configurations.
Technical details
The Database Backup for WordPress plugin is vulnerable to missing authorization (CWE-862) in versions up to and including 2.5.2. The vulnerability stems from the plugin failing to properly enforce the return value of its internal authorization checks. An unauthenticated attacker can exploit this over the network to trigger a database export and download the resulting file. This issue is specifically exploitable in WordPress Multisite environments that still utilize the deprecated is_site_admin() function. A patch has been released in subsequent versions to address the authorization logic.
Affected products
- WordPress Database Backup for WordPress Up to and including 2.5.2
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-db-backup/tags/2.5.2/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/changeset/3510595/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d4a21d0d-f455-4901-a04b-13c891cf8f75?source=cve