216.73.217.22

CVE-2026-4031

· Published 14/05/2026 13:16 · Modified 14/05/2026 14:28

Labels: CVE-2026-4031 2026-05-14CVE-2026-4031CWE-862[email protected]

Essential information

Published
14/05/2026 13:16
Modified
14/05/2026 14:28
Author
Creator
CVSS
7.5 HIGH (v3.1)
CISA KEV
No
CWE
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS metrics

Description

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.

NVD status

Status
Deferred — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
wordpress / database backup cpe:2.3:a:wordpress:database_backup:2.5.2:*:*:*:*:wordpress:*:*
wordpress / database backup cpe:2.3:a:wordpress:database_backup:*:*:*:*:*:wordpress:*:*

References