Authorization Bypass Vulnerability in Database Backup for WordPress Plugin by WordPress

CVE-2026-4031

What is CVE-2026-4031?

The Database Backup for WordPress plugin is susceptible to an authorization bypass vulnerability that allows unauthenticated attackers to manipulate the wp_db_temp_dir parameter. This oversight permits attackers to redirect database backups to publicly accessible directories, such as wp-content/uploads/. Once the backup is triggered, they can intercept sensitive files that may include database credentials, user password hashes, and personally identifiable information. This situation arises primarily when site administrators have active scheduled backups configured, thus increasing the risk of data exposure significantly.

References