Sensitive Information Exposure in Backup Daily Plugin for WordPress

CVE-2026-75133

What is CVE-2026-75133?

The Keep Backup Daily plugin for WordPress prior to version 2.1.4 has a vulnerability that compromises sensitive information. An unauthenticated attacker can exploit this flaw via the publicly accessible kbd_cron_process parameter to initiate a full MySQL database dump. This occurs without any authentication, enabling attackers to predict the dump filename based on the database name, a limited range of randomness, and the current Unix timestamp. The resulting backups can then be downloaded from the publicly available uploads directory, posing a severe risk to user data privacy and security.

References