Executive brief
A vulnerability in the Database Backup for WordPress plugin allows unauthorized individuals to read or delete sensitive files on a website's server. This could lead to the exposure of private data or a complete takeover of the website by an attacker. The issue specifically affects WordPress Multisite installations using older configurations.
Technical details
The Database Backup for WordPress plugin (up to version 2.5.2) contains a missing authorization vulnerability (CWE-862). The flaw stems from the plugin failing to properly enforce the return value of its authorization checks while simultaneously allowing user-controlled input for the backup directory parameter. An unauthenticated attacker can exploit this to read or delete arbitrary files on the server. This vulnerability is specifically exploitable in WordPress Multisite environments that still utilize the deprecated is_site_admin() function. A patch has been released in version 3510595 (trunk).
Affected products
- WordPress Database Backup for WordPress Up to and including 2.5.2
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-db-backup/tags/2.5.2/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/changeset/3510595/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e21b550-e1c5-4e23-9999-16c837353da9?source=cve