Executive brief
The Database Backup for WordPress plugin, used to automate website backups, contains a security flaw that allows unauthorized individuals to access full database backups. By manipulating where the plugin stores temporary files, an attacker can force a backup into a publicly accessible folder and download it. This could result in the theft of sensitive information, including customer data, user password hashes, and website configuration credentials.
Technical details
The Database Backup for WordPress plugin (up to version 2.5.2) fails to restrict access to the 'wp_db_temp_dir' parameter. An unauthenticated attacker can send a crafted request to 'wp-cron.php' with a poisoned 'wp_db_temp_dir' value, redirecting the backup output to a publicly accessible directory like 'wp-content/uploads/'. Because the plugin uses predictable naming conventions for backup files (based on database name, prefix, and Swatch Internet Time), an attacker can reliably guess the filename and download the backup before it is deleted. This vulnerability requires that scheduled backups are enabled on the target site. A patch is available in newer versions.
Affected products
- Austin Matzko Database Backup for WordPress Up to and including 2.5.2
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
References
- https://plugins.trac.wordpress.org/browser/wp-db-backup/tags/2.5.2/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
- https://plugins.trac.wordpress.org/changeset/3510595/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/36615cae-418f-48b0-ba69-b54515cbe1d7?source=cve