Database Backup for WordPress CVE-2026-4029

Exploitation requires WordPress Multisite environment with the deprecated is_site_admin() function present - specifically WordPress Multisite versions prior to 3.0 (pre-2010) or customized installations that restored this deprecated function. The target must be running Database Backup for WordPress plugin version 2.5.2 or earlier. No authentication, user interaction, or non-default plugin configuration required once these environmental prerequisites are met. Standard WordPress installations (non-Multisite) and modern WordPress Multisite versions (3.0+) are NOT vulnerable regardless of plugin version. The deprecated function dependency significantly limits the real-world attack surface, as the vast majority of WordPress Multisite deployments have upgraded beyond version 3.0 released over 15 years ago.

Real-world risk is MODERATE despite the High CVSS score, limited by narrow exploitation conditions. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates straightforward remote exploitation with high confidentiality impact - theoretically allowing any network attacker to dump database contents without authentication. However, this vulnerability ONLY affects WordPress Multisite environments still using the deprecated is_site_admin() function, significantly reducing the attack surface. The function was deprecated in WordPress 3.0 (released 2010), meaning exploitation requires either legacy WordPress Multisite installations over 15 years old or customized environments that restored deprecated functionality. Absence from CISA KEV suggests no widespread active exploitation campaigns targeting this specific condition. EPSS data not provided but likely low given the narrow deployment scenario. For organizations running modern WordPress Multisite (3.0+), risk is NEGLIGIBLE. For those on legacy Multisite or custom deployments, risk is HIGH as the attack is trivial once conditions are met (AC:L, PR:N). The pure confidentiality impact (I:N/A:N) means attackers gain data access but cannot modify databases or crash services through this vector alone, though exposed credentials could enable follow-on attacks.

An unauthenticated remote attacker identifies a WordPress Multisite installation running Database Backup for WordPress plugin version 2.5.2 or earlier through plugin enumeration techniques. The attacker crafts HTTP requests directly to the plugin's database export functionality (wp-db-backup.php), bypassing the broken authorization check. Since the plugin fails to enforce the return value of its authorization function in Multisite environments with is_site_admin() present, the attacker successfully triggers database table exports containing WordPress user credentials (including administrator password hashes), API keys, payment information if e-commerce plugins are present, and all site content including unpublished posts and private user data. Public exploit code availability not confirmed at time of analysis, though exploitation is straightforward (AC:L) given the clear authorization bypass mechanism visible in the source code references.