CVE-2026-4031

🗓️ 14 May 2026 12:32:02Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

Unauthenticated interception of backups via wp_db_temp_dir in WordPress plugin up to 2.5.2, exposing credentials.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-4031	14 May 202612:32	–	attackerkb
CNNVD	WordPress plugin Database Backup for WordPress 安全漏洞	14 May 202600:00	–	cnnvd
Cvelist	CVE-2026-4031 Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception	14 May 202612:32	–	cvelist
EUVD	EUVD-2026-30274	14 May 202612:32	–	euvd
NVD	CVE-2026-4031	14 May 202613:16	–	nvd
Positive Technologies	PT-2026-28187	25 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-4031	5 Jun 202619:14	–	redhatcve
Vulnrichment	CVE-2026-4031 Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception	14 May 202612:32	–	vulnrichment

Vulners

Node

wpengine database_backup_for_wordpressRange≤2.5.2wordpress

[
  {
    "vendor": "wpengine",
    "product": "Database Backup for WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.5.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
plugins	www.plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
plugins	www.plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php
plugins	www.plugins.trac.wordpress.org/browser/wp-db-backup/tags/2.5.2/wp-db-backup.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/36615cae-418f-48b0-ba69-b54515cbe1d7
plugins	www.plugins.trac.wordpress.org/changeset/3510595/
plugins	www.plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php

Parameter	Position	Path	Description	CWE
wp_db_temp_dir	query param	wp-cron.php	Authorization bypass via wp_db_temp_dir parameter allows unauthenticated access to scheduled backups, enabling interception of backup files and exposure of sensitive information.	CWE-862

17 Jun 2026 10:55Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.17.5

EPSS0.00343

SSVC

CWE-862