WordPress Database Backup Plugin Authorization Bypass Flaw

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due, intercept the backup file before it is cleaned up. The backup file has a predictable name based on the database name, table prefix, date, and Swatch Internet Time, making interception reliable. Successful exploitation leads to Sensitive Information Exposure including database credentials, user password hashes, and personally identifiable information. This vulnerability requires that the site administrator has configured scheduled backups.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Database Backup for WordPress plugin contains a critical authorization bypass vulnerability that allows unauthenticated attackers to manipulate database backup locations through the wp_db_temp_dir parameter. By exploiting insufficient access controls on wp-cron.php requests, attackers can redirect backups to publicly accessible directories like wp-content/uploads/, exposing sensitive database files containing credentials, user data, and configuration details. This vulnerability affects all versions up to 2.5.2 and represents a significant risk for any WordPress site using this plugin, as it requires no authentication and can be triggered remotely when scheduled backups are due.

Casky's 261 mapped skills leverage Claude's extended reasoning to correlate this vulnerability across MITRE ATT&CK's Privilege Escalation (TA0004) and Credential Access (TA0006) techniques. Practitioners would observe detection patterns including: unauthorized parameter manipulation attempts on wp-cron.php, unexpected write operations to publicly accessible directories via database backup processes, and unauthenticated requests triggering backup operations outside normal administrative patterns. The platform's CWE-862 (Missing Authorization) mapping helps security teams identify authorization control gaps in plugin architecture, while skill-based detection surfaces suspicious wp_db_temp_dir modifications and anomalous file placements that indicate exploitation attempts—enabling defenders to catch post-exploitation credential harvesting before attackers access exposed database backups.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-4031.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-4031

Casky has 261 skills that investigate the attack patterns behind CVE-2026-4031. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn