CVE-2025-4222: Database Toolset Plugin Info Disclosure

CVE-2025-4222 Overview

CVE-2025-4222 affects the Database Toolset plugin for WordPress in all versions up to and including 1.8.4. The plugin stores database backup files in a publicly accessible location, exposing sensitive information to unauthenticated remote attackers. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. An index file exists in the backup directory, meaning attackers must successfully brute force the backup filenames to retrieve their contents. Successful exploitation discloses full database contents, including WordPress user records, password hashes, session tokens, and application secrets.

Critical Impact
Unauthenticated attackers who guess backup filenames can download complete WordPress database dumps containing credentials and sensitive site data.

Affected Products

Database Toolset plugin for WordPress
All versions up to and including 1.8.4
WordPress sites where the plugin has generated backup archives

Discovery Timeline

2025-05-03 - CVE-2025-4222 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4222

Vulnerability Analysis

The Database Toolset plugin writes database backup archives to a directory served by the WordPress site's web server. Because the storage path is web-accessible, any client that requests the correct URL retrieves the backup file without authentication. The plugin does place an index file in the backup directory, which blocks directory listing. This forces an attacker to guess or enumerate the exact backup filename, which is why the vulnerability requires high attack complexity. Once a filename is discovered, the response returns the full SQL dump. This class of flaw maps to CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The current EPSS probability is 0.394%, placing the CVE in the 31st percentile of exploitation likelihood.

Root Cause

The root cause is an insecure storage design in the plugin's backup routine. The backup handler writes SQL archives into a location beneath the WordPress web root instead of a directory blocked by the web server. Relevant code paths are visible in the Database Toolset admin class and the backup class. The plugin does not enforce access control, does not require authentication for backup retrieval, and does not randomize filenames with sufficient entropy to resist brute forcing.

Attack Vector

An unauthenticated remote attacker sends HTTP GET requests to the plugin's backup directory using guessed or predictable filenames. When a filename matches an existing backup, the server returns the SQL archive. The attacker then extracts WordPress wp_users records, hashed passwords, options table entries such as API keys, and any other data stored in the database. See the Wordfence advisory and the Guy Shavit analysis for additional technical context.

Detection Methods for CVE-2025-4222

Indicators of Compromise

HTTP GET requests from external IPs targeting the Database Toolset backup directory with varying filenames, indicating brute force enumeration
Successful 200 OK responses returning .sql, .sql.gz, or .zip files from the plugin's backup path
Spikes of 404 responses from a single source against the backup directory, consistent with filename guessing

Detection Strategies

Review web server access logs for requests to paths containing database-toolset and backup file extensions
Alert on any external retrieval of backup archives outside of administrator IP ranges
Use file integrity monitoring to inventory backup files written by the plugin and confirm they are not web-accessible

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized log platform and build queries for the backup directory URI
Track unusual outbound data transfers correlated with requests to plugin paths
Monitor for follow-on credential stuffing or WordPress admin logins after suspected backup exposure

How to Mitigate CVE-2025-4222

Immediate Actions Required

Remove or relocate all existing Database Toolset backup files from the web-accessible directory to a location outside the WordPress document root
Rotate all WordPress administrator passwords, API keys, and secrets stored in the database if backup exposure is suspected
Restrict access to the plugin's backup directory using web server access controls until an updated plugin release is confirmed

Patch Information

At the time of the last NVD update on 2026-06-17, no fixed version beyond 1.8.4 is referenced in the advisory sources. Administrators should monitor the Wordfence advisory and the WordPress plugin repository for a patched release and upgrade immediately once available.

Workarounds

Deny web access to the plugin's backup directory using an .htaccess rule or equivalent Nginx location block
Move backup files to an offline storage location and disable in-plugin scheduled backups until a fix ships
Deactivate and remove the Database Toolset plugin if backups are not required, and use a maintained alternative that stores archives outside the web root

bash

# Apache .htaccess: deny web access to the plugin backup directory
# Place inside wp-content/uploads/database-toolset/ (or the plugin's backup path)
<FilesMatch "\.(sql|sql\.gz|zip|gz|tar)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (add to server block)
# location ~* /wp-content/uploads/database-toolset/.*\.(sql|gz|zip|tar)$ {
#     deny all;
#     return 403;
# }