CVE-2024-12330: WP Database Backup Information Disclosure

CVE-2024-12330 Overview

CVE-2024-12330 affects the WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress. All versions up to and including 7.3 expose backup files in a publicly accessible location. Unauthenticated attackers can download these files over the network and extract complete database contents.

The issue is classified under [CWE-530: Exposure of Backup File to an Unauthorized Control Sphere]. Because backups typically contain user records, credentials, session tokens, and configuration data, the exposure undermines the confidentiality of the entire WordPress site. The vulnerability requires no authentication or user interaction to exploit.

Critical Impact
Unauthenticated remote attackers can retrieve full database backups, exposing every record stored in the WordPress database, including user data and secrets.

Affected Products

WP Database Backup – Unlimited Database & Files Backup by Backup for WP (WordPress plugin)
All plugin versions up to and including 7.3
WordPress sites with default backup storage locations under the plugin's web-accessible directory

Discovery Timeline

2025-01-09 - CVE-2024-12330 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-12330

Vulnerability Analysis

The plugin writes database and file backups to a directory that the web server serves without access controls. There is no authentication check, signed URL, or .htaccess deny rule preventing direct HTTP requests to the backup archives. Anyone who learns or guesses the file path can retrieve a complete copy of the site's database.

The attack is network-based and requires no privileges or user interaction. An attacker who downloads a backup archive obtains the full WordPress database export, which typically includes the wp_users table with password hashes, email addresses, session tokens in wp_usermeta, API keys stored by other plugins, and private post content. The impact is limited to confidentiality, but the scope of disclosed data is broad.

Root Cause

The root cause is missing access control on the backup storage directory. Backup files are placed under the WordPress wp-content tree and inherit the default permissive web server configuration. The plugin does not add directory protection, randomize filenames sufficiently to resist enumeration, or relocate backups outside the document root.

Attack Vector

An unauthenticated attacker probes the target site for known backup paths used by the plugin. Common reconnaissance techniques include requesting predictable directory listings, parsing robots.txt, querying search engine indexes that may have cached backup URLs, and brute-forcing filenames based on timestamps. Once a backup URL is identified, the attacker issues a standard HTTP GET request to download the archive.

No exploit code is required because the vulnerability is exposed through normal HTTP retrieval. See the Wordfence Vulnerability Analysis for additional technical context and the WordPress Plugin Changeset for the upstream fix.

Detection Methods for CVE-2024-12330

Indicators of Compromise

Unauthenticated HTTP GET requests to paths under wp-content/uploads/ or plugin-specific directories containing .sql, .sql.gz, .zip, or .tar.gz archive extensions.
HTTP 200 responses with large response sizes for backup file requests from external IPs.
Access log entries from scanning tools or unusual user agents enumerating backup filenames containing date or hostname strings.

Detection Strategies

Review web server access logs for requests to the WP Database Backup plugin's storage directory and flag any successful downloads of archive files.
Run an authenticated content scan of the site to enumerate any backup artifacts that are reachable through the public web root.
Correlate WordPress plugin inventory data with the vulnerable version range to identify exposed installations across managed sites.

Monitoring Recommendations

Alert on any HTTP request whose response body exceeds a configured threshold and whose URL path matches backup archive extensions.
Monitor for repeated 404 responses against backup-style paths, which indicate active enumeration.
Track outbound traffic spikes from web servers that could indicate bulk archive exfiltration.

How to Mitigate CVE-2024-12330

Immediate Actions Required

Update the WP Database Backup plugin to a version newer than 7.3 as soon as the vendor publishes a fixed release.
Delete all existing backup files from any publicly accessible directory and regenerate them in a protected location.
Rotate WordPress administrator passwords, database credentials, API keys, and secret keys defined in wp-config.php, assuming exposure has occurred.

Patch Information

The upstream changes are tracked in the WordPress plugin repository. Review the WordPress Plugin Changeset 3209380 and WordPress Plugin Changeset 3209387 for the corrective commits and apply the latest plugin release that incorporates them.

Workarounds

Place an .htaccess file in the backup directory that denies all HTTP access, or configure the equivalent location block in Nginx.
Relocate the backup destination to a directory outside the web server document root.
Restrict access to the backup directory using IP allowlists at the web server or web application firewall layer.

bash

# Apache: deny public access to the WP Database Backup directory
# Place this in wp-content/uploads/db-backup/.htaccess
<FilesMatch "\.(sql|sql\.gz|zip|tar|tar\.gz)$">
    Require all denied
</FilesMatch>

# Nginx equivalent for the backup location
location ~* /wp-content/uploads/db-backup/.*\.(sql|sql\.gz|zip|tar|tar\.gz)$ {
    deny all;
    return 403;
}