CVE-2026-4030 Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup...

CVE-2026-4030: Missing Authorization

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup...

CVE-2026-4031: Missing Authorization

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wpdbtempdir parameter, which controls where database backups are written. This makes it possible for...

CVE-2026-4029: Missing Authorization

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to...

PT-2022-13976

Name of the Vulnerable Software and Affected Versions Database Backup for WordPress versions prior to 2.5.2 Description The issue is related to the lack of a CSRF check when updating schedule backup settings. This could allow an attacker to make a logged-in admin change these settings via a CSRF...

CVE-2022-1577: Cross-Site Request Forgery (CSRF)

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails t...

PT-2022-13073

Name of the Vulnerable Software and Affected Versions Database Backup for WordPress versions prior to 2.5.1 Description The issue arises from improper sanitization and escaping of the fragment parameter in SQL statements within the admin dashboard, leading to a SQL injection problem...

CVE-2022-0255: Improper Neutralization of Special Elements used in an SQL Command

The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue...

CVE-2021-24322: Improper Neutralization of Input During Web Page Generation

The Database Backup for WordPress plugin before 2.4 did not escape the backuprecipient POST parameter in before output it back in the attribute of an HTML tag, leading to a Stored Cross-Site Scripting issue...

PT-2021-15859

Name of the Vulnerable Software and Affected Versions Database Backup for WordPress versions prior to 2.4 Description The issue is related to a Stored Cross-Site Scripting problem. It occurs because the backup recipient POST parameter is not properly escaped before being output in an HTML tag...