Keep Backup Daily CVE-2026-75133

The Keep Backup Daily plugin must be installed and active on a WordPress site running a version before 2.1.4 - no non-default configuration is required beyond plugin activation. The kbd_cron_process trigger endpoint is accessible to unauthenticated remote users by default, and the WordPress uploads directory is publicly readable by default, meaning exploitation works against a standard plugin installation on a publicly reachable WordPress site. The primary limiting factor is filename prediction: the attacker must know or enumerate the WordPress database name (often guessable from wp-config.php leaks, error messages, or common defaults like wordpress) and brute-force the limited random component anchored to the dump-trigger timestamp. Sites behind a WAF or with uploads directory access controls are materially harder to exploit at the second stage.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H reflects the real-world threat accurately: fully remote, zero complexity, no privileges, no user interaction, and complete database confidentiality loss. The absence of a CISA KEV listing means mass exploitation is not confirmed, but this does not reduce operational risk - the attack is trivially scriptable and requires no specialized tooling beyond a standard HTTP client. No EPSS score was provided in the input data, so exploitation probability cannot be quantified. No public POC is referenced, but the technique (trigger dump, enumerate filename, fetch file) is well within the capability of any script-kiddie given the description's detail. The primary risk driver is the complete exposure of the WordPress database - containing user credentials (hashed), personally identifiable information, API keys stored in options tables, and all site content - to any internet-sourced attacker. This is a genuine high-priority remediation item, not a theoretical risk inflated by CVSS scoring.

An attacker sends an unauthenticated HTTP request to the target WordPress site with the kbd_cron_process parameter, causing the plugin to execute a full MySQL dump. The attacker then constructs candidate filenames using the known or guessable database name, iterates over the limited random component, and anchors the timestamp to the request time - issuing sequential GET requests to the uploads directory until the dump file is retrieved. No POC is publicly referenced, but this two-step technique is described in sufficient detail in the CVE to be independently reproduced.