CVE-2026-75133 Overview
CVE-2026-75133 is a sensitive information exposure vulnerability in the Keep Backup Daily plugin for WordPress before version 2.1.4. The flaw allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbd_cron_process parameter. Attackers can then predict the resulting dump filename using the database name, a limited random value range, and the current Unix timestamp. Once the filename is guessed, the backup archive can be downloaded directly from the publicly accessible WordPress uploads directory. The vulnerability is classified as missing authentication for a critical function [CWE-306].
Critical Impact
Unauthenticated remote attackers can force generation and retrieval of full MySQL database dumps, exposing all WordPress data including user credentials, session tokens, and site configuration.
Affected Products
- Keep Backup Daily plugin for WordPress, versions prior to 2.1.4
- WordPress sites with the plugin installed and activated
- Any environment exposing the plugin's cron endpoint to the public internet
Discovery Timeline
- 2026-08-31 - CVE-2026-75133 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-75133
Vulnerability Analysis
The Keep Backup Daily plugin exposes the kbd_cron_process action without any authentication or capability checks. When accessed, the handler executes the plugin's scheduled backup routine, which produces a full MySQL database dump on the server. The dump is written to a subdirectory of the WordPress wp-content/uploads path, which is served directly by the web server without access controls. Because the plugin does not restrict who can invoke the backup routine, any anonymous internet user can force the site to generate a fresh dump on demand.
Root Cause
The root cause is missing authentication on a security-critical function [CWE-306]. The kbd_cron_process entry point is intended to run as an internal scheduled task but is registered in a way that permits unauthenticated HTTP invocation. Compounding this, the resulting backup filename is only partially randomized. It is derived from the database name, a small random value, and the current Unix timestamp, which an attacker observing the request timing can enumerate within a tractable search space.
Attack Vector
An attacker sends an unauthenticated HTTP request to the vulnerable WordPress endpoint that triggers the kbd_cron_process action. The plugin generates a MySQL dump and stores it under the uploads directory. The attacker then brute-forces the predictable portion of the filename against the uploads path and downloads the archive. Refer to the VulnCheck Advisory on Plugin Vulnerability for a detailed description of the filename construction and request flow.
Detection Methods for CVE-2026-75133
Indicators of Compromise
- Unauthenticated HTTP requests containing the kbd_cron_process parameter in query strings or POST bodies.
- Unexpected .sql or archive files appearing under wp-content/uploads with filenames matching the database name followed by a numeric suffix and Unix timestamp.
- Bursts of GET requests against the uploads directory enumerating timestamp-based filenames.
- Outbound egress of large archive files from the WordPress host to unfamiliar IP addresses.
Detection Strategies
- Inspect web server access logs for any request referencing kbd_cron_process, especially from clients without a valid authenticated session.
- Correlate backup file creation events in wp-content/uploads with inbound HTTP requests to identify unauthorized backup generation.
- Alert on repeated 200 or 404 responses against the uploads directory that iterate through timestamp-shaped filenames.
Monitoring Recommendations
- Monitor file integrity on the wp-content/uploads tree and flag new database dump artifacts.
- Ingest WordPress and web server logs into a centralized SIEM to enable pattern matching for the vulnerable parameter across multiple hosts.
- Track outbound bandwidth from WordPress hosts and alert on transfers that align with dump file sizes.
How to Mitigate CVE-2026-75133
Immediate Actions Required
- Update the Keep Backup Daily plugin to version 2.1.4 or later on all WordPress sites.
- If patching is not immediately possible, deactivate and remove the plugin until it can be updated.
- Delete any existing backup files present in wp-content/uploads that may have been generated by unauthorized invocations.
- Rotate database credentials, WordPress secret keys, and administrative passwords if unauthorized backup generation is suspected.
Patch Information
Upgrade to Keep Backup Daily version 2.1.4 or later, which addresses the missing authentication on the kbd_cron_process handler. Consult the WordPress Plugin Documentation for release notes and installation guidance, and review the VulnCheck Advisory on Plugin Vulnerability for advisory details.
Workarounds
- Block unauthenticated HTTP requests containing the kbd_cron_process parameter at a web application firewall or reverse proxy.
- Restrict direct access to wp-content/uploads for .sql, .gz, and archive extensions using web server rules.
- Move WordPress backup storage outside the web-served document root and disable plugin cron endpoints exposed to unauthenticated users.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.