PT-2026-40909 · WordPress · Database Backup

Drew Webber · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-4029

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Database Backup for WordPress versions prior to 2.5.3

Description The plugin fails to properly enforce the return value of its authorization check, allowing unauthenticated attackers to export database tables. This leads to sensitive information exposure. This issue is only exploitable in WordPress Multisite environments where the deprecated is site admin() function exists.

Recommendations Update to a version later than 2.5.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4029

Affected Products

Database Backup

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-4029 · Security Note
• https://twitter.com/KaitanSecurity/status/2054917170799276453 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-db-backup/tags/2.5.2/wp-db-backup.php#L1623 · Note
• https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php#L153 · Note
• https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php#L1632 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d4a21d0d-f455-4901-a04b-13c891cf8f75?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3510595 · Note