CVE-2022-1577: Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-08 · updated 2026-06-17
Weakness: CWE-352

Description

The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule

Affected products

Database Backup for WordPress: before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: Database Backup for WordPress 2.5.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-1577 or the next vulnerability affects your stack