WP Database Backup <= 7.11 — Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under WP Database Backup – Unlimited Database & Files Backup by Backup for WP.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 7.12, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch WP Database Backup – Unlimited Database & Files Backup by Backup for WP to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Irwan Kusuma.

The WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress is vulnerable to OS Command Injection in all versions up to and including 7.11 via the `wp_db_exclude_table` parameter. This is due to the direct concatenation of user-supplied `$_POST['wp_db_exclude_table']` values into the `mysqldump` shell command string in the `mysqldump()` function of `includes/admin/class-wpdb-admin.php` without wrapping them in `escapeshellarg()`—every other argument in the same command (DB_USER, DB_PASSWORD, host, filename, DB_NAME) is properly escaped, making the exclude-table values the sole exception—and because the only applied filtering, `sanitize_text_field()` via `recursive_sanitize_text_field()`, strips HTML tags but leaves shell metacharacters such as `;`, `|`, `` ` ``, and `$()` intact. This makes it possible for authenticated attackers, with administrator-level access and above, to execute arbitrary operating system commands on the server, potentially enabling full remote code execution. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via `update_option('wp_db_exclude_table')` and later retrieved with `get_option()` and passed unsanitized to `shell_exec()` whenever a backup operation runs.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Jul 1, 2026

   CVE published

   Severity high, CVSS 7.2

2. Nov 13, 2026

   Record last updated