CVE-2019-25224 WP Database Backup < 5.2 - Unauthenticated OS Command Injection
CriticalCVSS 9.8
EPSS 22.1%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| databasebackup WP Database Backup – Unlimited Database & Files Backup by Backup for WP | < 5.2 | 5.2 |
| wpseeds wp database backup | < 5.2 | 5.2 |
| wordpress wp-database-backup(WordPress) | < 5.2 | 5.2 |
References
- www.wordfence.com third-party-advisory
- www.wordfence.com exploit third-party-advisory
- plugins.trac.wordpress.org patch
- blog.sucuri.net exploit third-party-advisory
- packetstormsecurity.com exploit third-party-advisory
- raw.githubusercontent.com exploit
- Wordfence Intelligence third-party-advisory
- www.cve.org