Arbitrary File Deletion Vulnerability in Database Backup Plugin for WordPress

CVE-2024-13910

Summary

The Database Backup and check Tables Automated With Scheduler plugin for WordPress suffers from an arbitrary file deletion vulnerability due to inadequate file path validation in its 'database_backup_ajax_delete' function across all versions up to and including 2.35. This flaw permits authenticated users with Administrator-level access to delete any file on the server. The consequences can be severe, as deletion of critical files, such as wp-config.php, could lead to remote code execution. This vulnerability was addressed in version 2.36, but users are advised to upgrade promptly to mitigate risks.

References