What’s Vulnerable › Vulnerabilities

CVE-2019-25224: WP Database Backup < 5.2 - Unauthenticated OS Command Injection

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 22.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-25 · updated 2026-06-17
• Weakness: CWE-78

Description

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

Affected products

• databasebackup WP Database Backup – Unlimited Database & Files Backup by Backup for WP: before 5.2 — fixed in 5.2

How to fix

Upgrade to a fixed version: databasebackup WP Database Backup – Unlimited Database & Files Backup by Backup for WP 5.2. Check the vendor advisory for mitigations.

References

• https://blog.sucuri.net/2019/06/os-command-injection-in-wp-database-backup.html
• https://packetstormsecurity.com/files/153781/
• https://plugins.trac.wordpress.org/changeset/2078035/wp-database-backup
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_db_backup_rce.rb
• https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d21cf285-9d75-43a2-9e81-67116f0bf896?source=cve

Get alerted when CVE-2019-25224 or the next vulnerability affects your stack