Description

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T16:19:11.227Z",
  "pubdate": "2026-08-31T16:19:11.227Z",
  "executiveSummary": "The Keep Backup Daily plugin for WordPress, in versions prior to 2.1.4, is susceptible to a critical sensitive information exposure vulnerability. This flaw stems from improper access control within the plugin's cron processing functionality, specifically the kbd_cron_process parameter. An unauthenticated remote attacker can trigger an automated MySQL database dump, which is subsequently stored in a publicly accessible directory. The vulnerability allows for the extraction of the entire site database, leading to a complete compromise of sensitive configuration data, user credentials, and potentially proprietary information. Due to the predictability of the resulting dump filenames—calculated using the database name, a restricted random number range, and the current Unix timestamp—attackers can reliably locate and download the generated backup files. This vulnerability poses a severe risk to confidentiality and data integrity, requiring immediate attention as it does not necessitate any authentication or elevated privileges to exploit.",
  "technicalDetails": "The vulnerability resides in the plugin's handling of automated tasks, specifically the kbd_cron_process mechanism. The root cause is a failure to enforce authentication checks or nonce verification when this parameter is invoked via an HTTP request. This lack of access control permits any unauthenticated user to trigger the plugin's internal database backup routine.\nUpon accessing the kbd_cron_process endpoint, the application initiates a full MySQL database dump. The plugin generates a backup file and writes it to the public /wp-content/uploads/ directory (or similar storage location), which is typically indexed or directly accessible via web browsers. Because the application logic for naming these backup files is deterministic, the security of the file is rendered ineffective through 'security through obscurity'.\nThe attack flow follows a structured exploitation path: First, an attacker identifies the target site's database name, which is often discoverable or can be brute-forced given the naming conventions of common hosting environments. Second, the attacker sends a request to the server triggering the kbd_cron_process. Third, the attacker calculates the potential filename by combining the database name, the known timestamp of the request, and iterating through the limited range of random integers used by the plugin's naming function. Finally, the attacker attempts to download the generated .sql or compressed backup file from the uploads directory. Since the backup process is triggered asynchronously, the attacker may perform repeated requests to ensure the file has been generated.\nThe impact of this exploit is catastrophic, as the resulting database dump contains the full contents of the site's MySQL database. This includes, but is not limited to, the wp_users table (storing password hashes), wp_options (containing sensitive API keys and configuration settings), and proprietary content. An attacker possessing this database dump can perform offline password cracking, gain administrative access to the WordPress dashboard, or leverage stored configuration tokens to move laterally within the server infrastructure. The exploitation requires no specific privileges and can be performed over the public network, making it a high-risk vector for automated scanning and mass exploitation."
}