What is the CVSS score of CVE-2026-4030?

CVE-2026-4030 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Database Backup for WordPress are affected by CVE-2026-4030?

Database Backup for WordPress versions 2.5.2 and earlier contains an unauthenticated arbitrary file read and deletion vulnerability affecting only Multisite installations, exposing sensitive files…

How to fix or mitigate CVE-2026-4030?

Within 24 hours: Audit all WordPress Multisite installations for Database Backup plugin presence and version (Settings > Plugins or via wp-cli). Disable or remove plugin version ≤2.5.2 immediately if identified. Within 7 days: Implement Web Application Firewall rules blocking requests to backup directory parameters; document any Multisite instances and prioritize migration to alternative backup solutions. Within 30 days: Upgrade to Database Backup version >2.5.2 once released, or transition to vendor-supported backup solutions; conduct file integrity audit on affected sites for unauthorized access.

Database Backup for WordPress CVE-2026-4030

EUVD-2026-30273 HIGH

Missing Authorization (CWE-862)

2026-05-14 Wordfence

GHSA-v7cf-3qh3-fc52

WordPress Authentication Bypass Information Disclosure Wordpress Plugin Database Backup For Wordpress Wpengine

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 13:16 vuln.today

CVE Published

May 14, 2026 - 12:32 nvd

HIGH 8.1

DescriptionCVE.org

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.

AnalysisAI

Arbitrary file read and deletion in Database Backup for WordPress (versions ≤2.5.2) allows unauthenticated attackers on WordPress Multisite installations to access sensitive files and potentially achieve site takeover. The vulnerability stems from improper authorization enforcement combined with user-controlled backup directory parameters, exploitable only in Multisite environments using the deprecated is_site_admin() function. CVSS 8.1 with high attack complexity (AC:H) reflects the Multisite-only prerequisite. No CISA KEV listing indicates limited observed exploitation despite the critical authorization bypass nature.

Technical ContextAI

This vulnerability (CWE-862: Missing Authorization) affects the Database Backup for WordPress plugin (CPE: cpe:2.3:a:wpengine:database_backup_for_wordpress). The flaw exists in the plugin's authorization framework where the return value of authorization checks is not properly enforced. Attackers can manipulate the backup directory parameter to specify arbitrary file paths. The vulnerability specifically relies on WordPress Multisite's deprecated is_site_admin() function, which was removed in WordPress 5.4 (2020) but may still exist in legacy Multisite installations. The combination of bypassed authorization checks and path traversal via user-controlled directory parameters enables both file enumeration (confidentiality breach) and deletion (integrity/availability impact), meeting the CVSS:3.1 ratings of C:H/I:H/A:H.

RemediationAI

Update to Database Backup for WordPress plugin version 2.5.3 or later, which addresses the authorization enforcement issue per changeset 3510595 visible at https://plugins.trac.wordpress.org/changeset/3510595/. For organizations unable to immediately update, implement compensating controls: disable the Database Backup for WordPress plugin entirely on Multisite installations until patched; upgrade WordPress core to version 5.4 or later (which removes the exploitable is_site_admin() function, effectively breaking the attack chain); restrict plugin access through .htaccess rules blocking direct access to wp-db-backup.php endpoints; implement Web Application Firewall rules detecting path traversal patterns in backup directory parameters (note: may cause legitimate backup operations to fail). Long-term, migrate away from deprecated Multisite functions and conduct security audit of all plugins relying on pre-5.4 WordPress APIs.