Database Backup for WordPress EUVD-2026-30274

Exploitation requires the WordPress site administrator to have enabled scheduled automated backups within the Database Backup for WordPress plugin settings - sites using only manual/on-demand backups are not vulnerable. Attacker must time malicious wp-cron.php requests to arrive before scheduled backup execution, requiring reconnaissance to determine backup schedule (typically discoverable through timing analysis of cron behavior or default configurations). The vulnerability enables remote unauthenticated exploitation against default plugin configurations when scheduled backups are active (CVSS PR:N confirms no authentication required). Exploitation is NOT limited by network access restrictions, user interaction requirements, or special deployment modes. The predictable backup filename format (database name + table prefix + date + Swatch Internet Time) is a limiting factor only in that attackers must correctly calculate these values, but all components are deterministic or discoverable through reconnaissance. WordPress sites without this specific plugin installed, or sites using the plugin exclusively for manual backups, are not affected.

CVSS 7.5 (High) reflects significant confidentiality impact with maximum attack surface exposure (network vector, low complexity, no privileges or interaction required). The vulnerability enables complete database exfiltration including authentication credentials and user data, but practical exploitation requires two preconditions: (1) administrator must have enabled scheduled backups, and (2) attacker must time requests to coincide with scheduled backup execution windows. This temporal constraint and configuration dependency reduce real-world exploitability compared to always-available RCE vulnerabilities. Without EPSS data, we cannot assess observed exploitation probability, but the publicly documented source code locations and detailed Wordfence analysis provide sufficient technical detail for exploit development. KEV status unknown - if not listed, suggests no confirmed mass exploitation despite high theoretical impact. The vulnerability is NOT remotely triggerable on-demand (requires waiting for scheduled cron), making automated scanning less effective than continuous configuration-aware attacks. Priority depends heavily on whether target sites use this plugin with scheduled backups enabled - defenders should verify actual deployment before prioritizing over vulnerabilities with lower configuration prerequisites.

An unauthenticated attacker identifies a WordPress site running Database Backup for WordPress ≤2.5.2 with scheduled daily backups at 02:00 UTC. At 01:55 UTC, the attacker sends crafted POST requests to wp-cron.php with wp_db_temp_dir=/wp-content/uploads/temp/ to poison the backup destination. When the scheduled backup executes at 02:00, the plugin writes the database dump to the attacker-controlled public directory with a predictable filename (e.g., backup-wp_-mydatabase-20260515-@847.sql). The attacker calculates the Swatch Internet Time and retrieves the file at https://victim.com/wp-content/uploads/temp/backup-wp_-mydatabase-20260515-@847.sql before the cleanup routine executes, obtaining complete database contents including wp_users table with bcrypt password hashes, wp_options with SMTP credentials, and customer PII from WooCommerce tables. Publicly accessible source code references provide implementation details for reliable exploitation.