PT-2026-40910 · WordPress · Database Backup

Drew Webber · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-4030

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Database Backup for WordPress versions prior to 2.5.3

Description The plugin allows unauthenticated attackers to read and delete arbitrary files on the server, which can lead to sensitive information exposure and potential site takeover. This occurs because the plugin fails to properly enforce the return value of its authorization check and uses a user-controlled backup directory parameter. This issue is only exploitable in WordPress Multisite environments where the deprecated is site admin() function is present.

Recommendations Update to a version later than 2.5.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4030

Affected Products

Database Backup

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-4030 · Security Note
• https://t.me/CVEtracker/53783 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3510595 · Note
• https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php#L121 · Note
• https://twitter.com/KaitanSecurity/status/2054917151341867213 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3e21b550-e1c5-4e23-9999-16c837353da9?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php#L1632 · Note
• https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php#L157 · Note
• https://plugins.trac.wordpress.org/browser/wp-db-backup/tags/2.5.2/wp-db-backup.php#L1623 · Note