What is the CVSS score of EUVD-2026-30272?

EUVD-2026-30272 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Database Backup for WordPress are affected by EUVD-2026-30272?

CVE-2026-4029 affects Database Backup for WordPress plugin versions 2.5.2 and earlier, allowing unauthenticated attackers to export complete database tables from WordPress Multisite installations,…

How to fix or mitigate EUVD-2026-30272?

Within 24 hours: Identify all WordPress Multisite installations using Database Backup for WordPress ≤2.5.2 via plugin audit. Within 7 days: disable or remove the Database Backup for WordPress plugin entirely pending vendor patch release, and audit database access logs for unauthorized export activity. Within 30 days: migrate to an alternative backup solution with proven security controls, update WordPress Multisite to current versions where possible to eliminate reliance on deprecated is_site_admin() function, and validate that no unauthorized database exports occurred.

Database Backup for WordPress EUVD-2026-30272

| CVE-2026-4029 HIGH

Missing Authorization (CWE-862)

2026-05-14 Wordfence

GHSA-p94x-gw9w-73f2

Authentication Bypass Information Disclosure WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 14, 2026 - 13:17 vuln.today

CVE Published

May 14, 2026 - 12:32 nvd

HIGH 7.5

DescriptionCVE.org

The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists.

AnalysisAI

Unauthenticated attackers can export complete database tables from WordPress Multisite installations running Database Backup for WordPress plugin ≤2.5.2, exposing credentials, user data, and site content. The vulnerability stems from improper enforcement of authorization check return values, bypassing security controls. Exploitation is limited to legacy WordPress Multisite environments using the deprecated is_site_admin() function. CVSS 7.5 (High) with network attack vector and no authentication required. No CISA KEV listing indicates limited widespread exploitation, though the unauthenticated remote access vector presents significant risk for affected configurations.

Technical ContextAI

This vulnerability exploits a logic flaw in the plugin's authorization mechanism within WordPress Multisite environments. The affected code fails to properly enforce the return value from its authorization check function, specifically in contexts where the deprecated is_site_admin() function is present. The CWE-862 (Missing Authorization) classification indicates the plugin performs privilege-sensitive operations without verifying the actor has permission to perform the requested action. The vulnerability exists in the database export functionality at wp-db-backup.php around lines 1623-1632, where authorization checks are bypassed. WordPress Multisite is a feature allowing multiple WordPress sites to share a single installation, and is_site_admin() was deprecated in WordPress 3.0 (2010) but may still exist in older or customized Multisite installations. The CPE identifies the vulnerable component as wpengine:database_backup_for_wordpress, affecting all versions through 2.5.2.

RemediationAI

Update to Database Backup for WordPress plugin version 2.5.3 or later, which addresses the authorization bypass per changeset 3510595 visible at https://plugins.trac.wordpress.org/changeset/3510595/. The fix properly enforces authorization check return values at lines 153 and 1632 in the trunk version (https://plugins.trac.wordpress.org/browser/wp-db-backup/trunk/wp-db-backup.php#L1632 and #L153). For organizations unable to immediately patch, implement these compensating controls: (1) Disable the Database Backup for WordPress plugin entirely until patching is completed - this eliminates the attack surface but removes backup functionality; (2) Upgrade WordPress Multisite to version 3.0 or later if running legacy versions, which removes the deprecated is_site_admin() function and prevents exploitation (note: major version upgrade carries compatibility risks with legacy plugins/themes); (3) Implement Web Application Firewall (WAF) rules blocking HTTP requests to wp-db-backup.php export endpoints from unauthenticated sources, specifically targeting the vulnerable functions around line 1623 - this may interfere with legitimate backup operations. All WordPress Multisite administrators should audit for presence of is_site_admin() function and verify current WordPress core version to determine actual exploitability.