What is the CVSS score of CVE-2026-4031?

CVE-2026-4031 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Database Backup for WordPress are affected by CVE-2026-4031?

CVE-2026-4031 is a critical authorization bypass in the Database Backup for WordPress plugin (versions ≤2.5.2) that allows unauthenticated attackers to intercept and download database backups…

How to fix or mitigate CVE-2026-4031?

Within 24 hours: Disable the Database Backup for WordPress plugin or immediately upgrade to version 2.5.3 or later if available from the vendor. Identify all WordPress installations using this plugin via inventory or plugin audit. Within 7 days: Rotate all database credentials, administrative passwords, and API keys that may have been exposed in backups. Scan database backup directories (typically wp-content/uploads or configured temp directories) for unauthorized access logs. Within 30 days: Implement alternative backup solutions with verified authentication controls; conduct security audit of any backups created while running vulnerable versions; review access logs for wp-cron.php requests from external IPs.

Database Backup for WordPress CVE-2026-4031

EUVD-2026-30274 HIGH

Missing Authorization (CWE-862)

2026-05-14 Wordfence

GHSA-7w7g-7m62-6985

Authentication Bypass PHP Information Disclosure WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 13:16 vuln.today

CVE Published

May 14, 2026 - 12:32 nvd

HIGH 7.5

DescriptionCVE.org

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.

AnalysisAI

Authorization bypass in Database Backup for WordPress plugin (≤2.5.2) enables unauthenticated attackers to redirect scheduled backup files to publicly accessible directories and retrieve them before cleanup. By poisoning the wp_db_temp_dir parameter via wp-cron.php, attackers can intercept database backups containing credentials, password hashes, and PII. Backup filenames follow predictable patterns (database name, table prefix, date, Swatch Internet Time), making interception reliable. Exploitation requires administrator-configured scheduled backups but no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N). EPSS and KEV data not provided; Wordfence-reported vulnerability with publicly accessible source code references enabling attack reproduction.

Technical ContextAI

The vulnerability exists in the Database Backup for WordPress plugin (cpe:2.3:a:wpengine:database_backup_for_wordpress), a PHP-based WordPress backup solution. The root cause is CWE-862 (Missing Authorization), where the plugin fails to validate the wp_db_temp_dir parameter that determines backup file storage locations. WordPress cron system (wp-cron.php) accepts external requests with arbitrary parameters, and this plugin trusts user-supplied paths without authentication checks. When scheduled backups execute, the plugin writes sensitive database dumps to attacker-controlled directories. The backup filename convention uses concatenated values (DB name + table prefix + timestamp in Swatch Internet Time format), creating a deterministic naming scheme. Source code references point to specific vulnerable functions in trunk/wp-db-backup.php lines 121, 85, 961, and 1568, with the fixed version implemented in changeset 3510595.

RemediationAI

Update Database Backup for WordPress plugin to version 2.5.3 or later, which implements authorization checks on the wp_db_temp_dir parameter per changeset 3510595 (https://plugins.trac.wordpress.org/changeset/3510595/). If immediate patching is not feasible, implement these compensating controls with noted trade-offs: (1) Disable scheduled backups via plugin settings and perform manual backups only during maintenance windows - eliminates attack window but reduces backup frequency and operational resilience; (2) Configure web server rules to block direct access to wp-cron.php from external IPs, allowing only internal/localhost requests - breaks legitimate external cron services and may require alternative scheduling mechanisms; (3) Implement Web Application Firewall rules to detect and block requests to wp-cron.php containing wp_db_temp_dir parameters - may generate false positives if legitimate plugin functionality uses this parameter. Long-term: transition to enterprise backup solutions with proper access controls rather than relying on plugins with historically weak authorization models.