Database Backup for WordPress EUVD-2026-30273

Exploitation requires a WordPress Multisite installation running WordPress core version prior to 5.4 (released April 2020) where the deprecated is_site_admin() function still exists. Standard single-site WordPress installations cannot be exploited regardless of plugin version or WordPress core version. The Database Backup for WordPress plugin version 2.5.2 or earlier must be active. No authentication is required (PR:N) but the attacker must identify the Multisite configuration and presence of the deprecated function (High Complexity - AC:H). Single-site WordPress deployments and Multisite installations on WordPress 5.4+ inherently limit exploitation as the is_site_admin() dependency is absent.

Real-world risk is moderate despite CVSS 8.1 High severity due to multiple limiting factors. The AC:H (High Complexity) rating accurately reflects that exploitation requires a WordPress Multisite installation still using the deprecated is_site_admin() function - discontinued since WordPress 5.4 (April 2020). Installations running WordPress 5.4+ cannot be exploited. No CISA KEV listing suggests this has not been widely exploited in the wild. EPSS data not provided but likely low given the narrow attack surface (Multisite-only, deprecated function dependency). However, for the subset of vulnerable Multisite installations, the unauthenticated network attack vector (AV:N/PR:N) combined with arbitrary file access represents critical risk. Wordfence discovery and patch availability (changeset 3510595) provide clear remediation path. Priority: High for confirmed Multisite users on WordPress <5.4; Low for standard WordPress installations or Multisite on 5.4+.

An unauthenticated attacker identifies a WordPress Multisite installation running WordPress core <5.4 with Database Backup for WordPress plugin ≤2.5.2 active. The attacker crafts HTTP requests to the plugin's backup management endpoints, manipulating the backup directory parameter to point to sensitive system files (e.g., /etc/passwd, wp-config.php, or .ssh/authorized_keys). By exploiting the failed authorization check tied to is_site_admin(), the attacker reads database credentials, authentication secrets, or user data. Subsequently, the attacker deletes critical files (such as .htaccess or plugin files) to disable security controls or cause denial of service, then uses stolen credentials to establish persistent administrative access and achieve full site takeover.