CVE-2025-4222
Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.
Reserved 2025-05-02 | Published 2025-05-03 | Updated 2025-05-13 | Assigner WordfenceCWE-200 Exposure of Sensitive Information to an Unauthorized Actor
| 2025-05-02: | Disclosed |
Guy Shavit
www.wordfence.com/...-9e26-41a1-8dea-4bafaf735bee?source=cve
plugins.trac.wordpress.org/...ss-database-toolset-backup.php
plugins.trac.wordpress.org/...ass-database-toolset-admin.php
www.guyshavit.com/post/cve-2025-4222
Support options
