CVE-2024-13910: WordPress Database Backup Path Traversal

CVE-2024-13910 Overview

CVE-2024-13910 is an arbitrary file deletion vulnerability in the Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress. The flaw exists in the database_backup_ajax_delete function due to insufficient file path validation. All versions up to and including 2.35 are affected. Authenticated attackers with Administrator-level access can delete arbitrary files on the server. Deleting critical files such as wp-config.php can trigger the WordPress setup flow, enabling remote code execution. The vulnerability was partially patched in version 2.36. This weakness is classified under CWE-22 (Path Traversal).

Critical Impact
Authenticated administrators can delete arbitrary server files via unvalidated path input, potentially leading to full site takeover through wp-config.php deletion and reinstallation.

Affected Products

Database Backup and check Tables Automated With Scheduler 2024 (WordPress plugin) versions ≤ 2.35
Version 2.36 (partial patch only — not fully remediated)
WordPress installations using the database-backup plugin

Discovery Timeline

2025-03-01 - CVE-2024-13910 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13910

Vulnerability Analysis

The vulnerability resides in the database_backup_ajax_delete AJAX handler of the Database Backup plugin. The function accepts a file path parameter from authenticated requests but fails to validate or sanitize the input against the intended backup directory. An attacker with Administrator privileges can supply a traversal-style path referencing files outside the plugin's backup storage location.

This is a classic path traversal weakness (CWE-22). Because the deletion routine operates with the web server's file system permissions, it can remove any file the WordPress process can access. Deletion of wp-config.php is the most consequential outcome. When WordPress starts without a configuration file, it presents the installation wizard, allowing the attacker to reconnect the site to a database they control and execute arbitrary PHP through theme or plugin modifications.

The requirement for Administrator-level access limits the pool of viable attackers but does not eliminate risk. Compromised administrator credentials, session hijacking, or supply-chain attacks against admin users all provide viable entry paths.

Root Cause

The root cause is missing path canonicalization and allow-list validation in the database_backup_ajax_delete function. User-supplied file paths are passed to file deletion APIs without confirming that the resolved absolute path stays within the designated backup directory. See the plugin source at line 267 for the affected handler.

Attack Vector

An authenticated administrator sends a crafted AJAX POST request to the plugin's delete endpoint. The request includes a filename parameter containing directory traversal sequences pointing to a target file outside the backup folder. The plugin resolves the path and calls the deletion routine, removing the target file. The attacker then triggers the WordPress installer or exploits missing-file behavior to escalate to remote code execution.

See the Wordfence Vulnerability Report for additional analysis of the exploitation chain.

Detection Methods for CVE-2024-13910

Indicators of Compromise

Unexpected deletion of wp-config.php, .htaccess, or PHP files outside the plugin's backup directory
WordPress installation wizard (/wp-admin/install.php) unexpectedly accessible on a production site
POST requests to admin-ajax.php with action=database_backup_ajax_delete and filename parameters containing ../ sequences
New administrator accounts or modified theme/plugin PHP files following backup plugin activity

Detection Strategies

Monitor web server access logs for AJAX calls to database_backup_ajax_delete with suspicious filename parameters
File integrity monitoring on wp-config.php and other WordPress core files
Alert on any HTTP request containing ..%2F or ../ in POST bodies to admin-ajax.php
Correlate administrator session activity with file deletion events on the WordPress host

Monitoring Recommendations

Enable WordPress audit logging to capture administrator actions and plugin AJAX calls
Forward web server and PHP error logs to a centralized SIEM for path traversal pattern matching
Track version strings of installed plugins and flag hosts still running database-backup ≤ 2.35
Watch for unexpected access to /wp-admin/install.php or /wp-admin/setup-config.php on live sites

How to Mitigate CVE-2024-13910

Immediate Actions Required

Deactivate and remove the Database Backup and check Tables Automated With Scheduler 2024 plugin until a fully patched release is confirmed available
Audit administrator accounts, rotate credentials, and enforce multi-factor authentication on all WordPress admin users
Verify integrity of wp-config.php and back it up to an out-of-band location
Review web server logs for prior exploitation attempts targeting the vulnerable AJAX endpoint

Patch Information

Version 2.36 introduced a partial fix via changeset 3247917 and changeset 3248708. Because the patch is described as partial, administrators should treat 2.36 as an interim measure and monitor the plugin repository for a complete remediation. If a fully patched version is not yet available, uninstall the plugin.

Workarounds

Restrict administrator access with IP allow-listing at the web server or WAF layer
Deploy a web application firewall rule blocking admin-ajax.php requests where the action parameter is database_backup_ajax_delete and the filename contains traversal sequences
Make wp-config.php immutable at the filesystem level using chattr +i on Linux to prevent deletion
Replace the plugin with a maintained backup solution that has undergone recent security review

bash

# Protect wp-config.php from deletion on Linux hosts
sudo chattr +i /var/www/html/wp-config.php

# Verify immutable attribute is set
lsattr /var/www/html/wp-config.php

# Example WAF rule (ModSecurity) to block traversal in the vulnerable action
SecRule ARGS:action "@streq database_backup_ajax_delete" \
  "chain,phase:2,deny,status:403,id:1013910,\
  msg:'CVE-2024-13910 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.\\)" "t:none,t:urlDecode"