EUVD-2026-41262
GHSA-9g3c-r4j4-8m9r
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Payload is delivered over the network (AV:N) with low complexity, but requires administrator privileges (PR:H) and no user interaction; command execution yields full host compromise, so C/I/A all High.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Database Backup - Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the wp_db_exclude_table parameter. This is due to the direct concatenation of user-supplied $_POST['wp_db_exclude_table'] values into the mysqldump shell command string in the mysqldump() function of includes/admin/class-wpdb-admin.php without wrapping them in escapeshellarg()-every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception-and because the only applied filtering, sanitize_text_field() via recursive_sanitize_text_field(), strips HTML tags but leaves shell metacharacters such as ;, |, ` `, and $() intact. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary operating system commands on the server, potentially enabling full remote code execution. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via update_option('wp_db_exclude_table') and later retrieved with get_option() and passed unsanitized to shell_exec()` whenever a backup operation runs.
AnalysisAI
Authenticated OS command injection in the WP Database Backup plugin for WordPress (all versions up to and including 7.11) lets administrator-level users execute arbitrary operating system commands on the underlying server, escalating a WordPress admin foothold into full host RCE. The flaw stems from the wp_db_exclude_table POST parameter being concatenated unescaped into the mysqldump shell command; the injection is stored, so payloads persist in the options table and fire whenever a backup runs. Reported by Wordfence with no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
The vulnerability lives in the mysqldump() function of includes/admin/class-wpdb-admin.php, where the plugin builds a shell command string to invoke the mysqldump binary via shell_exec(). CWE-77 (Command Injection) is the root-cause class: every other argument in that command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is wrapped in escapeshellarg(), but the user-supplied exclude-table values are concatenated directly. The only filtering applied is sanitize_text_field() through recursive_sanitize_text_field(), which strips HTML tags but leaves shell metacharacters such as ;, |, backtick, and $() fully intact, so a value like ';id' or $(command) breaks out of the intended argument context. The CPE cpe:2.3:a:databasebackup:wp_database_backup_-_unlimited_database_&_files_backup_by_backup_for_wp:*:* identifies the affected package, a WordPress backup plugin written in PHP.
RemediationAI
No vendor-released patched version is identified in the provided data; a WordPress plugin trac changeset (3574273) is referenced (https://plugins.trac.wordpress.org/changeset?reponame=&old=3574273%40wp-database-backup&new=3574273%40wp-database-backup) which may contain the fix, but a specific fixed release version is not independently confirmed here - administrators should consult the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/0a97a217-b00b-4268-a472-8d62ae1d18e3?source=cve) and update to the latest plugin release once a fixed version is published. As compensating controls until a confirmed patched version is installed: deactivate the WP Database Backup plugin to eliminate the code path entirely (trade-off: you lose scheduled/automated backups and must back up the database by another means such as mysqldump run outside WordPress or a host-level snapshot); tightly restrict who holds WordPress administrator accounts and enforce strong MFA on them, since only admins can reach the vulnerable settings form; and inspect the wp_db_exclude_table value stored in the wp_options table for shell metacharacters such as ;, |, backticks or $() and clear any suspicious value before the next backup runs, since the stored injection would otherwise fire on the next backup regardless of who triggers it.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-77 – Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today