CVE-2019-25224
WP Database Backup < 5.2 - Unauthenticated OS Command Injection
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
WP Database Backup < 5.2 - Unauthenticated OS Command Injection
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
Reserved 2025-07-24 | Published 2025-07-25 | Updated 2025-07-25 | Assigner WordfenceCWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
| 2019-04-24: | Disclosed |
www.wordfence.com/...-9d75-43a2-9e81-67116f0bf896?source=cve
www.wordfence.com/...y-patched-in-wp-database-backup-plugin/
plugins.trac.wordpress.org/...set/2078035/wp-database-backup
blog.sucuri.net/...mand-injection-in-wp-database-backup.html
packetstormsecurity.com/files/153781/
raw.githubusercontent.com/.../multi/http/wp_db_backup_rce.rb
Support options
