CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
Explanation of Vulnerability in Simple Terms
WP Database Backup versions before 5.2 contain a command injection vulnerability that allows unauthenticated attackers to run arbitrary code on the site without user interaction. The vulnerability exists in how the plugin processes user input when handling backup operations. An attacker can exploit this remotely over the network to gain full control of the WordPress installation.
What an attacker can do
Run arbitrary code on your site and take complete control without needing a login.
Potential impact on your site
Complete site compromise. An attacker can steal data, modify content, install malware, or delete your entire database.
Conditions required to exploit
None. The attacker needs only network access; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
