WordPress plugin
WP Database Backup – Unlimited Database & Files Backup by Backup for WP security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 14 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High6
- Medium6
- Low0
All WP Database Backup – Unlimited Database & Files Backup by Backup for WP vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter ≤7.11Update to 7.12 | CVE-2026-9834 | |
| High7.5 | Unauthenticated Database Back-Up Exposure ≤7.3Update to 7.4 | CVE-2024-12330 | |
| High7.5 | Unauthenticated Information Disclosure ≤5.5Update to 5.5.1 | CVE-2020-7241 | |
| Critical9.8 | Unauthenticated OS Command Injection <5.2Update to 5.2 | CVE-2019-25224 | |
| Critical9.8 | Unauthenticated Settings Update to Remote Code Execution ≤5.1.2Update to 5.1.3 | — | |
| High8.8 | Cross-Site Request Forgery <4.3.6Update to 4.3.6 | — | |
| High8.8 | Cross-Site Request Forgery <4.3.3Update to 4.3.3 | CVE-2016-10874 | |
| High8.8 | Cross-Site Request Forgery ≤4.3Update to 4.3.1 | CVE-2016-10876 |
- High7.2Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
≤7.11Update to 7.12
- High7.5Unauthenticated Database Back-Up Exposure
≤7.3Update to 7.4
- High7.5Unauthenticated Information Disclosure
≤5.5Update to 5.5.1
- Critical9.8Unauthenticated OS Command Injection
<5.2Update to 5.2
- Critical9.8Unauthenticated Settings Update to Remote Code Execution
≤5.1.2Update to 5.1.3
- High8.8Cross-Site Request Forgery
<4.3.6Update to 4.3.6
- High8.8Cross-Site Request Forgery
<4.3.3Update to 4.3.3
- High8.8Cross-Site Request Forgery
≤4.3Update to 4.3.1
WP Database Backup – Unlimited Database & Files Backup by Backup for WP: common questions
Does WP Database Backup – Unlimited Database & Files Backup by Backup for WP have known vulnerabilities?
Yes. VulnCrest Radar lists 14 known vulnerabilities in WP Database Backup – Unlimited Database & Files Backup by Backup for WP: 2 critical, 6 high, 6 medium. None are known to affect version null.
How do I check which version of WP Database Backup – Unlimited Database & Files Backup by Backup for WP I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP Database Backup – Unlimited Database & Files Backup by Backup for WP vulnerability?
CVE-2026-9834, published Jul 1, 2026: WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter. Severity: High (CVSS 7.2).
Is any WP Database Backup – Unlimited Database & Files Backup by Backup for WP vulnerability listed in CISA KEV?
No. None of the known WP Database Backup – Unlimited Database & Files Backup by Backup for WP vulnerabilities is currently listed in the CISA KEV catalog.