Attack Chain

1. Attacker performs reconnaissance to identify WordPress sites running the Keep Backup Daily plugin.
2. Attacker sends an unauthenticated HTTP GET/POST request to the target site using the kbd_cron_process parameter to trigger the backup generation script.
3. The plugin executes the backup routine, dumping the MySQL database into a file within the /wp-content/uploads/ directory.
4. Attacker monitors the request or estimates the Unix timestamp at the time of execution.
5. Attacker iterates through possible filenames based on the database name and the predictable timestamp and random range.
6. Attacker attempts to download the generated backup file directly via standard web request.
7. Attacker successfully exfiltrates the complete database contents.

Impact

Successful exploitation leads to the complete exfiltration of the WordPress database. This includes sensitive data such as site administrator credentials, hashed user passwords, configuration files, and PII of registered users. The breach of this data provides an attacker with the necessary information to perform full account takeover or further compromise the hosting environment.

Recommendation

• Patch the Keep Backup Daily plugin to version 2.1.4 or later immediately across all WordPress installations.
• Deploy the provided Sigma rule to detect attempts to invoke the kbd_cron_process parameter from unauthenticated sources.
• Audit web server logs for suspicious access patterns targeting the /wp-content/uploads/ directory with file extensions indicative of database backups (e.g., .sql, .zip, .sql.gz).
• Implement restrictions on the web server to prevent direct access to sensitive file types within the uploads directory.