CVE-2026-4029: WordPress Multisite Plugin Exposes Database

The National Vulnerability Database (NVD) reports CVE-2026-4029, a high-severity vulnerability (CVSS 7.5) affecting the Database Backup for WordPress plugin, versions up to and including 2.5.2. This flaw allows unauthenticated attackers to export database tables due to improper authorization enforcement. The root cause is the plugin’s failure to adequately validate the return value of its authorization check, leading to sensitive information exposure.

Critically, this vulnerability is specifically exploitable in WordPress Multisite environments that still utilize the deprecated is_site_admin() function. This narrows the attack surface but makes the impact severe for affected deployments. An unauthenticated attacker can dump an entire database, which is a worst-case scenario for data confidentiality.

For defenders, this is a clear call to action. The attacker’s calculus is straightforward: find unpatched WordPress Multisite instances with this plugin and deprecated function, then exfiltrate data. The low attack complexity (AV:N/AC:L/PR:N/UI:N) means it’s an easy target for opportunistic attackers. If you’re running WordPress Multisite, a proactive audit is non-negotiable.