PT-2025-30720 · Databasebackup+2 · Wp Database Backup – Unlimited Database & Files Backup By Backup For Wp+2

Published 2025-07-25 · Updated 2025-07-25 · CVE-2019-25224

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Database Backup versions prior to 5.2

Description An OS Command Injection flaw exists in the mysqldump() function, allowing unauthenticated attackers to execute arbitrary commands on the host operating system.

Recommendations Update to version 5.2 or later. As a temporary workaround, consider disabling the mysqldump() function until the update is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-25224

Affected Products

Wp Database Backup – Unlimited Database & Files Backup By Backup For Wp

Wp-Database-Backup

Wp Database Backup

References · 8

• 🔥 https://packetstormsecurity.com/files/153781 · Exploit
• 🔥 https://blog.sucuri.net/2019/06/os-command-injection-in-wp-database-backup.html · Exploit
• 🔥 https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_db_backup_rce.rb · Exploit
• 🔥 https://wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin · Exploit
• https://plugins.trac.wordpress.org/changeset/2078035/wp-database-backup · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-25224 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25224 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/d21cf285-9d75-43a2-9e81-67116f0bf896?source=cve · Note