What the vulnerability does
01Description
The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.
Explanation of Vulnerability in Simple Terms
02Summary
The Database Backup for WordPress plugin through version 2.5.2 lacks proper authorization checks, allowing unauthenticated attackers to read, modify, or delete backup data and potentially access sensitive site information. The vulnerability requires specific network conditions to exploit but can compromise confidentiality, integrity, and availability of backups. Site administrators should update immediately to a patched version.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete WordPress backups and access sensitive site data without authentication.
Potential impact on your site
04Site Impact
Attackers can steal, corrupt, or destroy your WordPress backups, potentially preventing site recovery after an incident.
Conditions required to exploit
05Prerequisites
Network access to the site; no user authentication required, but exploitation requires specific network conditions.
Key dates
06Disclosure timeline
May 14, 2026
CVE published
May 14, 2026
Record updated
