Unauthorized File Access Vulnerability in Database Backup Plugin for WordPress

CVE-2026-4030

What is CVE-2026-4030?

The Database Backup for WordPress plugin is susceptible to unauthorized arbitrary file read and deletion due to improper enforcement of authorization checks. This vulnerability affects all versions up to and including 2.5.2. Attackers with malicious intent can exploit a user-controlled backup directory parameter to access and delete server files. This vulnerability poses significant risks, especially in WordPress Multisite environments, as it could lead to sensitive information exposure and potential site takeover.

References