What the vulnerability does
01Description
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Explanation of Vulnerability in Simple Terms
02Summary
The Database Backup for WordPress plugin through version 2.5.2 lacks proper authorization checks, allowing unauthenticated attackers to read sensitive backup data over the network. No user interaction is required. The vulnerability exposes confidential information but does not allow modification or deletion of data. Sites running affected versions should update immediately.
What an attacker can do
03Attacker Capabilities
Read backup files and sensitive data without logging in.
Potential impact on your site
04Site Impact
Attackers can download your site's backup files containing database contents, user data, and configuration.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
