Wp Database Backup Vulnerabilities

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into th...

CVSS:

7.2

Affected:

up to 7.11

Fixed in:

7.12

Disclosed:

Jul 1, 2026

CVE-2026-9834 on NVD →

[en] The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

Affected:

up to 5.2

Fixed in:

5.2

Disclosed:

Jul 25, 2025

CVE-2019-25224 on NVD →

[en] The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including...

Affected:

up to 7.4

Fixed in:

7.4

Disclosed:

Jan 9, 2025

CVE-2024-12330 on NVD →

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.3 via publicly accessible back-up files. This makes it possible for unauthenticated attackers to extract sensitive data including all i...

CVSS:

7.5

Affected:

up to 7.3

Fixed in:

7.4

Disclosed:

Jan 8, 2025

CVE-2024-12330 on NVD →

[en] The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Affected:

up to 5.9

Fixed in:

5.9

Disclosed:

Sep 5, 2022

CVE-2022-2271 on NVD →

The WP Database Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 5.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inject...

CVSS:

5.5

Affected:

up to 5.8.3

Fixed in:

5.9

Disclosed:

Aug 16, 2022

CVE-2022-2271 on NVD →

The WP Database Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inject a...

CVSS:

5.5

Affected:

up to 5.8

Fixed in:

5.9

Disclosed:

Aug 9, 2022

The WP Database Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative level permissions and above to inject a...

Affected:

up to 5.9

Fixed in:

5.9

Disclosed:

Aug 9, 2022

The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, and mak...

CVSS:

7.5

Affected:

up to 5.5

Fixed in:

5.5.1

Disclosed:

Feb 6, 2020

CVE-2020-7241 on NVD →

[en] The WP Database Backup plugin through 5.5 for WordPress stores downloads by default locally in the directory wp-content/uploads/db-backup/. This might allow attackers to read ZIP archives by guessing random ID numbers, guessing date strings with a 2020_{0..1}{0..2}_{0..3}{0..9} format, guessing UNIX timestamps, an...

Affected:

up to 5.5.1

Fixed in:

5.5.1

Disclosed:

Jan 20, 2020

CVE-2020-7241 on NVD →

[en] The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

Affected:

up to 4.3.1

Fixed in:

4.3.1

Disclosed:

Aug 12, 2019

CVE-2016-10875 on NVD →

[en] The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

Affected:

up to 5.1.2

Fixed in:

5.1.2

Disclosed:

Aug 12, 2019

CVE-2019-14949 on NVD →

[en] The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

Affected:

up to 4.3.1

Fixed in:

4.3.1

Disclosed:

Aug 12, 2019

CVE-2016-10876 on NVD →

[en] The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

Affected:

up to 4.3.3

Fixed in:

4.3.3

Disclosed:

Aug 12, 2019

CVE-2016-10874 on NVD →

[en] The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

Affected:

up to 4.3.3

Fixed in:

4.3.3

Disclosed:

Aug 12, 2019

CVE-2016-10873 on NVD →

Unauthenticated OS Command Injection vulnerability found by WordFence in WordPress WP Database Backup plugin (versions <= 5.1.2).

Affected:

up to 5.2

Fixed in:

5.2

Disclosed:

May 29, 2019

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

CVSS:

9.8

Affected:

up to 5.2

Fixed in:

5.2

Disclosed:

Apr 24, 2019

CVE-2019-25224 on NVD →

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

Affected:

up to 5.2

Fixed in:

5.2

Disclosed:

Apr 24, 2019

The wp-database-backup plugin before 5.1.2 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 5.1.1

Fixed in:

5.1.2

Disclosed:

Apr 22, 2019

CVE-2019-14949 on NVD →

The WP Database Backup plugin for WordPress is vulnerable to unauthenticated settings update that can lead to remote code execution via the wpsetting functionality in versions up to, and including, 5.1.2. This makes it possible for unauthenticated attackers to inject malicious code into settings that will execute when...

CVSS:

9.8

Affected:

up to 5.1.2

Fixed in:

5.1.3

Disclosed:

Mar 24, 2019

The WP Database Backup plugin for WordPress is vulnerable to unauthenticated settings update that can lead to remote code execution via the wpsetting functionality in versions up to, and including, 5.1.2. This makes it possible for unauthenticated attackers to inject malicious code into settings that will execute when...

Affected:

up to 5.1.3

Fixed in:

5.1.3

Disclosed:

Mar 24, 2019

The WP Database Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.5. This is due to missing or incorrect nonce validation on the wp_db_backup_admin_init() function. This makes it possible for unauthenticated attackers to modify backups via a forged request gra...

CVSS:

8.8

Affected:

up to 4.3.6

Fixed in:

4.3.6

Disclosed:

Oct 21, 2016

The WP Database Backup plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.5. This is due to missing or incorrect nonce validation on the wp_db_backup_admin_init() function. This makes it possible for unauthenticated attackers to modify backups via a forged request gra...

Affected:

up to 4.3.6

Fixed in:

4.3.6

Disclosed:

Oct 21, 2016

The wp-database-backup plugin before 4.3.3 for WordPress has CSRF.

CVSS:

8.8

Affected:

up to 4.3.3

Fixed in:

4.3.3

Disclosed:

Aug 4, 2016

CVE-2016-10874 on NVD →

The wp-database-backup plugin before 4.3.3 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 4.3.3

Fixed in:

4.3.3

Disclosed:

Aug 3, 2016

CVE-2016-10873 on NVD →

The wp-database-backup plugin before 4.3.1 for WordPress has XSS.

CVSS:

6.1

Affected:

up to 4.3.1

Fixed in:

4.3.1

Disclosed:

Aug 1, 2016

CVE-2016-10875 on NVD →

The wp-database-backup plugin before 4.3.1 for WordPress has CSRF.

CVSS:

8.8

Affected:

up to 4.3

Fixed in:

4.3.1

Disclosed:

Apr 8, 2016

CVE-2016-10876 on NVD →

The WP Database Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions before 3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...

CVSS:

6.4

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Aug 20, 2015

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Aug 20, 2015

The WP Database Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions before 3.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user...

Affected:

up to 3.4

Fixed in:

3.4

Disclosed:

Aug 20, 2015

The WP Database Backup WordPress plugin was affected by an Unauthenticated OS Command Injection security vulnerability.

Affected:

up to 5.2

Fixed in:

5.2

The WP Database Backup WordPress plugin was affected by a Cross-Site Request Forgery (CSRF) security vulnerability.

Affected:

up to 4.3.6

Fixed in:

4.3.6

The WP Database Backup WordPress plugin was affected by an Authenticated Stored Cross-Site Scripting (XSS) security vulnerability.

Affected:

up to 3.4

Fixed in:

3.4