PT-2025-18936 · WordPress · Database Toolset

Guy Shavit · Published 2025-05-03 · Updated 2025-05-03 · CVE-2025-4222

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Database Toolset plugin for WordPress versions up to, and including, 1.8.4

Description The issue allows unauthenticated attackers to extract sensitive data from database backup files stored in a publicly accessible location. This is possible because an index file is present, although a brute force attack would be required to compromise any data.

Recommendations For Database Toolset plugin for WordPress versions up to, and including, 1.8.4, update to a version later than 1.8.4 to prevent sensitive information exposure. As a temporary workaround, consider restricting access to the backup files stored in publicly accessible locations to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-4222

Affected Products

Database Toolset

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4222 · Security Note
• https://twitter.com/VulmonFeeds/status/1918513441955791004 · Twitter Post
• https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L247 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/fa452a9a-9e26-41a1-8dea-4bafaf735bee?source=cve · Note
• https://t.me/cvedetector/24384 · Telegram Post
• https://twitter.com/CVEnew/status/1918568443290501147 · Twitter Post
• https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-backup.php#L76 · Note
• https://guyshavit.com/post/cve-2025-4222 · Note
• https://t.me/cvetracker/22984 · Telegram Post