CVE-2026-4029

High

Published: 14/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The Database Backup plugin for WordPress is vulnerable to unauthorized database export in all versions up to and including 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check, allowing unauthenticated attackers to export database tables.

Risk Assessment

This vulnerability leads to Sensitive Information Exposure, which can jeopardize the security of organizational data. It is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.

Recommendation

It is recommended to update the Database Backup plugin to the latest version and review the security configuration of WordPress Multisite to minimize the risk of unauthorized access.

Other vulnerabilities in Database Backup for WordPress plugin

CVE-2026-4031High
The Database Backup plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.5.2. The issue arises from the plugin not restricting access to the wp_db_temp_dir parameter, allowing unauthenticated attackers to intercept backup files.

Original NVD description (English source)

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.