Database Backup for WordPress Plugin Vulnerable to Auth Bypass

The Database Backup for WordPress plugin, across all versions up to and including 2.5.2, is susceptible to an authorization bypass. The National Vulnerability Database (NVD) reports that this flaw, tracked as CVE-2026-4031, stems from the plugin’s failure to restrict access to the wp_db_temp_dir parameter. This parameter dictates where database backups are stored, creating a critical exposure point.

Unauthenticated attackers can exploit this by sending a crafted request to wp-cron.php with a poisoned wp_db_temp_dir value. By pointing this value to a publicly accessible directory, such as wp-content/uploads/, attackers can intercept a scheduled backup file if one is due. The NVD notes that backup filenames are predictably generated, making interception reliable. Successful exploitation leads to sensitive information exposure, including database credentials, user password hashes, and personally identifiable information. This vulnerability is contingent on the site administrator having configured scheduled backups.

With a CVSS score of 7.5 (HIGH), this vulnerability presents a serious risk. Defenders must recognize that an unauthenticated attacker can achieve full database access if this flaw is unpatched and scheduled backups are enabled. The attacker’s calculus here is simple: target a common plugin, exploit a predictable file path, and walk away with the keys to the kingdom. This isn’t theoretical; it’s a direct path to a full compromise.