CVE-2026-75133 in Keep Backup Daily Plugin
Summary
by MITRE • 08/31/2026
Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/31/2026
The Keep Backup Daily plugin for WordPress versions prior to 2.1.4 contains a critical sensitive information exposure vulnerability that stems from improper access control mechanisms within its automated backup functionality. This flaw allows unauthenticated attackers to trigger a full MySQL database dump by interacting with the publicly exposed kbd_cron_process parameter without requiring any form of authentication or valid session tokens. The core technical issue lies in the plugin's failure to verify user privileges before executing sensitive administrative operations, effectively treating an internal cron-like process as accessible via standard HTTP requests from any source on the internet. This misconfiguration transforms a routine maintenance feature into a direct vector for data exfiltration, bypassing WordPress’s typical authentication layers entirely.
The operational impact of this vulnerability is severe due to the nature and accessibility of the generated backup files. Once an attacker triggers the dump process by accessing the vulnerable endpoint with specific parameters, the plugin generates a complete SQL export of the entire database associated with the WordPress installation. This includes user credentials, password hashes, configuration settings containing API keys or secret tokens, post content, and potentially sensitive customer data if e-commerce plugins are installed. The vulnerability is further exacerbated by the predictability of the backup file location. Attackers can determine the exact filename of the generated dump based on a combination of factors including the database name, a limited range of random characters used in the naming convention, and the current Unix timestamp at the time of execution. This partial predictability significantly reduces the effort required to locate and download the sensitive data from the publicly accessible uploads directory where WordPress stores media files by default.
From a classification perspective, this vulnerability aligns with CWE-209 which describes the generation of an error message that includes sensitive information about the environment or internal state, although in this case it is more accurately categorized under CWE-732 for improper permission assignment and CWE-522 for insufficiently protected credentials. The attack vector corresponds to ATT&CK technique T1504.006 which involves Web Shell: WordPress Plugins/Themes, as the attacker leverages a legitimate plugin feature to achieve unauthorized data access. Furthermore, it relates to ATT&CK tactic TA0009 Collection due to the systematic gathering of database contents that can be used for further compromise or identity theft. The ability to predict file names also touches upon CWE-358 regarding exposure of private information through side channels like timing or predictable naming schemes.
Mitigation strategies must address both immediate remediation and long-term security posture improvements. The primary and most effective solution is to upgrade the Keep Backup Daily plugin to version 2.1.4 or later where this access control flaw has been patched by enforcing strict authentication checks on all administrative endpoints including cron processes. Administrators should also audit their WordPress installation for any other plugins that expose internal functions via public URLs without proper nonce verification and capability checks. To reduce the blast radius of such vulnerabilities, it is recommended to configure backup storage locations outside of the publicly accessible web root directory or restrict access to those directories using server-level configurations such as .htaccess rules in Apache or location blocks in Nginx that deny direct file access for SQL files. Additionally implementing Web Application Firewall (WAF) rules can help detect and block requests targeting known vulnerable parameters like kbd_cron_process from unauthenticated sources, providing a layer of defense-in-depth while updates are applied. Regular security audits focusing on input validation and authorization checks in third-party plugins are essential to prevent similar exposures in the future.