Executive brief
Keep Backup Daily is a WordPress plugin that automatically backs up a site's MySQL database and emails it to administrators. An unauthenticated attacker can trigger a full database dump without logging in by accessing a public parameter, and then predict and download the backup file from the web server. This could expose all sensitive data stored in the database, including customer information, login credentials, and configuration details.
Technical details
The vulnerability is a missing authentication flaw (CWE-306) in the `kbd_cron_process` parameter handler. Unauthenticated attackers can access this publicly exposed parameter without any credentials to trigger a full MySQL database export. The generated backup file is saved to the publicly accessible WordPress uploads directory with a partially predictable filename based on the database name, a limited random component, and the Unix timestamp. An attacker can enumerate and download the backup file, gaining complete access to the database contents. The vulnerability affects Keep Backup Daily versions before 2.1.4. A patch is available in version 2.1.4 and later.
Affected products
- Fahad Mahmood Keep Backup Daily before 2.1.4
Timeline
- 2026-08-31: disclosed