CVE-2019-25224criticalCWE-78

CVE-2019-25224: critical vulnerability in databasebackup WP Database Backup – Unlimited…

WP Database Backup < 5.2 - Unauthenticated OS Command Injection

Published · Updated

Follow this CVE+ Monitor WP Database Backup – Unlimited Database & Files Backup by Backup for WP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

68Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 22%
from disclosure to weaponsame day
Published on NVDJul 25
metasploitApr 24
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
databasebackup · WP Database Backup – Unlimited Database & Files Backup by Backup for WP
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — databasebackup WP Database Backup – Unlimited…

In the same product, most dangerous first.

CVE-2026-9834HIGHWP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' ParameterEPSS 2.7%CVE-2024-12330HIGHWP Database Backup – Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up ExposureEPSS 0.5%