Brief Summary: CVE 2026 4031 in Database Backup for WordPress Plugin Enables Unauthenticated Database Interception

Introduction

A missing authorization check in the Database Backup for WordPress plugin allows unauthenticated attackers to silently redirect scheduled database backups to publicly accessible directories and then download the resulting SQL dump, which contains database credentials, password hashes, and personally identifiable information. The CVSS score is 7.5, and a predictable filename scheme makes interception reliable. WordPress administrators running scheduled backups need to address it promptly.

The Database Backup for WordPress plugin, maintained by Delicious Brains, gives site administrators a straightforward way to back up core WordPress database tables and either download them or receive them by email. It has been a long-standing WordPress utility. The flaw tracked as CVE 2026 4031 affects all versions of the plugin up to and including 2.5.2.

Technical Information

Root Cause: Missing Authorization on Directory Parameter (CWE 862)

The vulnerability comes from the plugin's handling of the wp_db_temp_dir parameter. This parameter controls the filesystem path where the plugin writes database backup files during the backup process. Before version 2.5.3, the plugin accepted wp_db_temp_dir as a GET request parameter without any authentication or authorization checks. Nothing verified that the requester held administrative privileges, or even that the request came from an authenticated user at all.

Any unauthenticated visitor could therefore influence where the plugin stored its backup output, simply by including the parameter in a request.

Attack Flow

Exploiting CVE 2026 4031 takes five steps:

1. The attacker identifies a WordPress site running the Database Backup for WordPress plugin (versions up to 2.5.2) with scheduled backups configured. Without scheduled backups, the attack does not work.

2. The attacker sends a crafted request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory on the web server, such as wp-content/uploads/.

3. If a scheduled backup is due to run (WordPress cron jobs execute when triggered by page loads or direct requests to wp-cron.php), the plugin writes the full database export to the attacker-controlled directory instead of its intended, protected location.

4. The attacker works out the backup's filename. The legacy filename scheme used the database name, table prefix, date, and Swatch Internet Time. Each of these is either publicly discoverable (the default WordPress table prefix is wp_, and the database name can sometimes be inferred) or calculable (date and Swatch Internet Time are deterministic), so the attacker can construct the exact filename.

5. The attacker requests the predicted filename from the public directory (e.g., https://target.com/wp-content/uploads/[predicted_filename].sql) and downloads the complete database dump before the plugin's cleanup routine removes it.

What Gets Exposed

A successful attack yields the entire WordPress database export, which typically includes:

• Database credentials stored in configuration tables
• User password hashes from the wp_users table
• Personally identifiable information including email addresses, usernames, and any data stored by plugins (e.g., WooCommerce orders, form submissions)
• WordPress secret keys and salts if stored in the database
• All post content, comments, and site configuration

How the Fix Works

Version 2.5.3 fixes the vulnerability with three changes:

1. The code that processed the wp_db_temp_dir GET parameter was removed entirely, so external requests can no longer influence the backup directory.

2. Backup filenames now include a 12-character cryptographic nonce generated by wp_generate_password( 12, false ), which makes the resulting filename effectively impossible to predict.

3. The plugin now runs strict can_user_backup() authorization checks before the backup process can be initialized, so only authorized users can trigger or influence backups.

Affected Systems and Versions

• Plugin: Database Backup for WordPress (wp-db-backup)
• Affected versions: All versions up to and including 2.5.2
• Fixed version: 2.5.3 (released April 20, 2026)
• Precondition: The site administrator must have configured scheduled backups for the vulnerability to be exploitable

Vendor Security History

Delicious Brains released version 2.5.3 to fix three unauthenticated vulnerabilities, including CVE 2026 4031, all discovered by security researcher Drew Webber:

Three separate unauthenticated access vulnerabilities patched at once suggests a systemic gap in the plugin's authorization model before this coordinated fix. Addressing every reported issue in a single release is a good sign for how the vendor responds to security disclosures.

References

• Wordfence Threat Intel Advisory for CVE 2026 4031
• WordPress Plugin Changeset 3510595 (Patch Diff)
• Vulnerable Source: wp-db-backup.php (v2.5.2, Line 121)
• Patched Source: wp-db-backup.php (trunk, Line 121)
• Patched Source: wp-db-backup.php (trunk, Line 85)
• Patched Source: wp-db-backup.php (trunk, Line 961)
• Patched Source: wp-db-backup.php (trunk, Line 1568)
• GitHub: Delicious Brains wp-db-backup
• Feedly CVE 2026 4031 Tracking