Security Alert Summary
The Keep Backup Daily plugin for WordPress contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing a publicly exposed parameter. The generated backup can be predicted and downloaded from the uploads directory, exposing database contents.
CVE Details
- CVE ID: CVE-2026-75133
- Affected plugin / component: Keep Backup Daily plugin for WordPress
- Affected versions: Versions before 2.1.4
- Published: August 31, 2026 at 4:19 PM (UTC)
- Last modified: August 31, 2026 at 4:19 PM (UTC)
- CVSS v3.1 base score: 7.5
- CVSS v3.1 severity: HIGH
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-306
Technical Details
The plugin exposes a parameter named kbd_cron_process that can be accessed without authentication. When triggered, this parameter causes the plugin to generate a full MySQL database dump and write the resulting file to the publicly accessible uploads directory.
Attackers can predict the location and name of the generated backup because the filename is partially predictable based on the database name, a limited random range, and the current Unix timestamp. With that predictability, an unauthenticated actor can download the backup file and obtain sensitive database contents.
The impact is limited to the information contained in the exported database files. The advisory does not describe additional missing authorization checks or other endpoints beyond the exposed kbd_cron_process parameter.
How This Could Impact Your Website
In a typical small or medium-sized WordPress site, the site owner maintains administrative control, internal staff manage content, and external contractors or contributors may have limited accounts. If an attacker downloads a database backup, exposed data could include user records, email addresses, private posts, configuration data, or other stored content depending on your site and plugins.
Practical consequences include exposure of internal user email addresses and other personal data, which increases the risk of targeted phishing or social engineering against staff or contractors. An exposed backup does not necessarily imply full site compromise, but it can significantly raise the likelihood of follow-on attacks against people and systems linked to the site.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and other low-privilege accounts that may expose additional data.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and server access logs for unusual behavior, including unexpected downloads from the uploads directory.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
