Unauthorized Database Export in Database Backup Plugin for WordPress

CVE-2026-4029

What is CVE-2026-4029?

The Database Backup for WordPress plugin is susceptible to unauthorized database exports due to improper enforcement of authorization checks in all versions up to and including 2.5.2. This flaw allows unauthenticated attackers to access sensitive database tables, particularly in WordPress Multisite environments where the deprecated is_site_admin() function is present. This vulnerability poses significant risks as it can lead to the exposure of confidential information stored in the database.

References