Database Backup for WordPress Plugin <= 2.5.2 — CraftedSignal Threat Feed

CVE-2026-4031 - Database Backup for WordPress Plugin Authorization Bypass

hello@craftedsignal.io — Thu, 14 May 2026 13:19:40 +0000

The Database Backup for WordPress plugin, versions 2.5.2 and earlier, contains an authorization bypass vulnerability (CVE-2026-4031). This flaw stems from the plugin’s failure to restrict access to the wp_db_temp_dir parameter. Unauthenticated attackers can exploit this vulnerability by sending a crafted request to wp-cron.php, poisoning the wp_db_temp_dir value to point to a publicly accessible directory, such as wp-content/uploads/. If a scheduled database backup is due, the attacker can intercept the backup file before it is cleaned up. The predictable naming convention of the backup file (based on database name, table prefix, date, and Swatch Internet Time) makes successful interception highly probable. This exploitation results in the exposure of sensitive information, including database credentials, user password hashes, and personally identifiable information (PII). This vulnerability requires that the site administrator has configured scheduled backups for exploitation.

Attack Chain

An unauthenticated attacker identifies a WordPress site using the vulnerable Database Backup for WordPress plugin with scheduled backups enabled.
The attacker crafts a malicious HTTP request targeting wp-cron.php.
The request includes a poisoned wp_db_temp_dir parameter, setting it to a publicly accessible directory such as wp-content/uploads/.
The attacker sends the crafted HTTP request to the WordPress site’s wp-cron.php.
If a scheduled database backup is triggered by the wp-cron.php execution, the plugin writes the backup file to the attacker-controlled directory.
The attacker leverages the predictable naming scheme (database name, table prefix, date, and Swatch Internet Time) to determine the exact filename of the backup.
The attacker retrieves the backup file from the publicly accessible directory via HTTP(S).
The attacker extracts sensitive information, including database credentials, user password hashes, and personally identifiable information, from the intercepted backup file.

Impact

Successful exploitation of CVE-2026-4031 allows unauthenticated attackers to access sensitive information stored within the WordPress database backups. This includes database credentials, user password hashes, and personally identifiable information. The number of victims depends on the prevalence of the vulnerable plugin and the number of sites with scheduled backups enabled. This can lead to complete compromise of the WordPress site and potentially other systems if the database credentials are reused.

Recommendation

Upgrade the Database Backup for WordPress plugin to the latest version (greater than 2.5.2) to patch CVE-2026-4031.
Monitor web server logs for POST requests to wp-cron.php with suspicious wp_db_temp_dir parameters (see Sigma rule Detect Suspicious wp_db_temp_dir Parameter in wp-cron.php).
Implement strict file access controls on the wp-content/uploads/ directory to prevent unauthorized access to any files written there.
Review and restrict access to wp-cron.php to prevent unauthorized triggering of scheduled tasks.

Database Backup for WordPress Plugin Arbitrary File Read and Deletion Vulnerability (CVE-2026-4030)

hello@craftedsignal.io — Thu, 14 May 2026 13:19:26 +0000

The Database Backup for WordPress plugin, versions 2.5.2 and earlier, contains an arbitrary file read and deletion vulnerability (CVE-2026-4030). This flaw stems from the plugin’s failure to properly enforce the return value of its authorization checks. Coupled with a user-controlled backup directory parameter, this weakness allows unauthenticated attackers to read and delete arbitrary files on the affected WordPress server. This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists. Successful exploitation can lead to sensitive information exposure and potential site takeover, impacting the confidentiality and integrity of the targeted WordPress installation.

Attack Chain

An unauthenticated attacker identifies a WordPress Multisite installation using the vulnerable Database Backup for WordPress plugin (<= 2.5.2).
The attacker crafts a malicious HTTP request targeting the plugin’s functionality related to backup directory handling.
The crafted request leverages the user-controlled backup directory parameter to specify a target file path outside the intended backup directory.
The plugin fails to properly validate or sanitize the provided file path due to the insufficient authorization check.
The plugin attempts to access the specified file based on the attacker-controlled path.
If the request is for file reading, the plugin exposes the contents of the targeted file to the attacker in the HTTP response. If the request is for file deletion, the targeted file is removed from the server.
The attacker gains unauthorized access to sensitive information, such as configuration files, database credentials, or other user data.
The attacker uses the exposed information to further compromise the WordPress installation, potentially leading to a full site takeover.

Impact

Successful exploitation of CVE-2026-4030 allows unauthenticated attackers to read arbitrary files on the server. This can lead to the exposure of sensitive information, including configuration files, database credentials, and user data. Attackers can also delete arbitrary files, potentially disrupting website functionality and leading to data loss. In WordPress Multisite environments, this can lead to a full site takeover, affecting all sites within the network. The overall impact is a compromise of confidentiality, integrity, and availability of the affected WordPress installation.

Recommendation

Upgrade the Database Backup for WordPress plugin to version 2.5.3 or later to patch CVE-2026-4030.
Monitor web server logs for suspicious requests containing file paths outside the intended backup directory to detect potential exploitation attempts. Deploy the Sigma rules provided in this brief to your SIEM.
Implement strong file permission controls on the WordPress server to limit access to sensitive files.
Consider disabling the Database Backup for WordPress plugin in WordPress Multisite environments if the is_site_admin() function is deprecated.
Review WordPress Multisite configurations and ensure proper access controls are in place to prevent unauthorized file access.
Enable webserver logging to capture cs-uri-stem and cs-uri-query for request analysis (see Sigma rule).

CVE-2026-4029: Database Backup for WordPress Plugin Unauthorized Database Export

hello@craftedsignal.io — Thu, 14 May 2026 13:19:11 +0000

The Database Backup for WordPress plugin, in versions up to and including 2.5.2, is vulnerable to an unauthorized database export flaw. This vulnerability, identified as CVE-2026-4029, stems from the plugin’s failure to properly enforce the return value of its authorization check. The vulnerability specifically affects WordPress Multisite environments where the deprecated is_site_admin() function is present. Successful exploitation allows unauthenticated attackers to export database tables, potentially leading to sensitive information exposure. Defenders should ensure the plugin is updated to a version beyond 2.5.2 or implement compensating controls to restrict access to database export functionality.

Attack Chain

Attacker identifies a WordPress Multisite instance using Database Backup for WordPress plugin version 2.5.2 or earlier.
Attacker crafts a malicious HTTP request to the plugin’s database export functionality, bypassing the intended authorization checks.
The plugin’s authorization check fails to properly validate the user’s permissions due to improper enforcement of the return value.
The plugin initiates a database export operation.
The database tables are exported and made accessible to the unauthenticated attacker.
The attacker downloads the exported database, which contains sensitive information.
Attacker analyzes the database content to extract sensitive credentials, configuration details, or user data.

Impact

Successful exploitation of CVE-2026-4029 allows unauthenticated attackers to export sensitive database tables from vulnerable WordPress Multisite installations. This can lead to the exposure of usernames, passwords, API keys, customer data, and other confidential information stored in the database. The impact is high due to the potential for complete compromise of the affected WordPress site and the sensitive data it manages.

Recommendation

Upgrade the Database Backup for WordPress plugin to the latest version (greater than 2.5.2) to patch CVE-2026-4029.
Monitor web server logs for suspicious requests to database export endpoints associated with the Database Backup for WordPress plugin, using the Sigma rule Detect Unauthorized WordPress Database Export.
In WordPress Multisite environments, investigate any unusual activity related to the is_site_admin() function or database backup operations.