CVE-2024-13911: WordPress Database Backup Plugin Flaw

CVE-2024-13911 Overview

CVE-2024-13911 affects the Database Backup and check Tables Automated With Scheduler 2024 plugin for WordPress. All versions up to and including 2.35 expose sensitive information through the /dashboard/backup.php file. Authenticated attackers with Administrator-level access can extract full database credentials from the plugin dashboard. The weakness is classified under CWE-200 as an exposure of sensitive information to an unauthorized actor.

Critical Impact
Administrator-level accounts on affected WordPress sites can retrieve full database credentials, enabling direct database access outside of WordPress and potential lateral movement to shared database infrastructure.

Affected Products

Database Backup and check Tables Automated With Scheduler 2024 WordPress plugin, versions up to and including 2.35
WordPress sites running the vulnerable plugin with Administrator or higher accounts provisioned
Shared database environments where credentials extracted from one site grant access to additional resources

Discovery Timeline

2025-03-01 - CVE-2024-13911 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13911

Vulnerability Analysis

The plugin's dashboard/backup.php file renders database connection details directly into the administrative interface. According to the referenced code review, lines 62 through 66 expose database configuration values that include the database host, name, user, and password. Any user session with Administrator privileges can request the page and read these values from the rendered HTML.

This behavior turns the plugin dashboard into a credential disclosure primitive. WordPress stores database credentials in wp-config.php with filesystem-level restrictions. Rendering them in the browser bypasses those controls and shifts the trust boundary from filesystem access to any administrative session.

Root Cause

The root cause is improper handling of sensitive configuration data in the plugin's user interface layer. The code reads database constants and outputs them without masking, redaction, or an access check beyond the standard WordPress administrator capability. There is no separation between operational metadata needed for backup scheduling and secret material required only by the database driver.

Attack Vector

Exploitation requires an authenticated network request from an account holding Administrator privileges or higher. The attacker navigates to the plugin's backup dashboard endpoint and reads database credentials from the response. Scenarios that enable this include compromised administrator sessions, stolen administrator cookies, insider abuse, or chained exploitation where a lower-severity flaw grants administrator access first. Extracted credentials permit direct connections to the database server if network reachability exists.

Refer to the WordPress Plugin Code Review at line 62 and the Wordfence Vulnerability Analysis for technical details on the affected code path.

Detection Methods for CVE-2024-13911

Indicators of Compromise

HTTP GET requests to /wp-admin/admin.php referencing the database-backup plugin dashboard from unusual source addresses or outside normal administrator hours
New or unexpected database sessions originating from external IPs using the DB_USER value defined in wp-config.php
Administrator accounts accessing dashboard/backup.php without a corresponding backup job execution in plugin logs
Outbound traffic from a WordPress host to the database server initiated by a non-web process

Detection Strategies

Monitor WordPress access logs for requests to the plugin's backup.php endpoint and correlate with the requesting user role and IP address
Alert on database authentication events using WordPress credentials from client addresses other than the web server
Track plugin inventory across sites and flag installations of the Database Backup and check Tables Automated With Scheduler 2024 plugin at version 2.35 or earlier

Monitoring Recommendations

Enable WordPress audit logging to record administrator page views and configuration reads
Forward web server and database authentication logs to a central SIEM for correlation across the WordPress and database tiers
Establish a baseline of legitimate administrator activity so credential-exposure page loads stand out

How to Mitigate CVE-2024-13911

Immediate Actions Required

Update the Database Backup and check Tables Automated With Scheduler 2024 plugin to a version later than 2.35 that includes the fix from WordPress Changeset 3247917
Rotate the WordPress database user password defined in wp-config.php and update the configuration file with the new value
Audit Administrator-level accounts and remove or downgrade any that are not strictly required
Review database server logs for authentication attempts using the WordPress database user from unexpected sources

Patch Information

The vendor addressed the issue in WordPress Changeset 3247917, which modifies the code path in dashboard/backup.php responsible for rendering database configuration. Administrators should install the fixed release through the standard WordPress plugin update workflow and confirm the running version after upgrade.

Workarounds

Deactivate and remove the plugin until the patched version is installed
Restrict access to /wp-admin/ by source IP address using web server rules or a web application firewall
Enforce multi-factor authentication for all Administrator accounts to reduce the risk of session compromise leading to credential extraction
Isolate the WordPress database user with least-privilege grants and network access lists that only permit connections from the web server

bash

# Example: restrict database user to the web server host only
REVOKE ALL PRIVILEGES ON *.* FROM 'wp_user'@'%';
CREATE USER 'wp_user'@'10.0.0.10' IDENTIFIED BY 'NEW_STRONG_PASSWORD';
GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, DROP, INDEX, ALTER ON wordpress.* TO 'wp_user'@'10.0.0.10';
FLUSH PRIVILEGES;