WP Database Backup – Unlimited Database & Files Backup by Backup for WP

WP Database Backup – Unlimited Database & Files Backup by Backup for WP has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 6 high. 2016 was the busiest year with 5 disclosures.

The most common weakness is Cross-Site Scripting, behind 6 of the records (43%). Other recurring categories include Cross-Site Request Forgery (CSRF), Command Injection.

Every one of the 14 issues recorded for WP Database Backup – Unlimited Database & Files Backup by Backup for WP has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, one record each. WP Database Backup – Unlimited Database & Files Backup by Backup for WP is installed on roughly 30,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

01234567891021.03.2014Today20.08.20156.4WP Database Backup < 3.4 - Authenticated Stored Cross-Site Scripting CVSS 6.4 · 20.08.201508.04.20168.8WP Database Backup <= 4.3 - Cross-Site Request Forgery CVSS 8.8 · 08.04.201601.08.20166.1WP Database Backup <= 4.3 - Cross-Site Scripting CVSS 6.1 · 01.08.201603.08.20166.1WP Database Backup <= 4.3.2 - Cross-Site Scripting CVSS 6.1 · 03.08.201604.08.20168.8WP Database Backup <= 4.3.2 - Cross-Site Request Forgery CVSS 8.8 · 04.08.201621.10.20168.8WP Database Backup <= 4.3.5 - Cross-Site Request Forgery CVSS 8.8 · 21.10.201624.03.20199.8WP Database Backup <= 5.1.2 - Unauthenticated Settings Update to Remote Code Execution CVSS 9.8 · 24.03.201922.04.20196.1WP Database Backup <= 5.1.1 - Cross-Site Scripting CVSS 6.1 · 22.04.201924.04.20199.8WP Database Backup < 5.2 - Unauthenticated OS Command Injection CVSS 9.8 · 24.04.201906.02.20207.5WP Database Backup <= 5.5 - Unauthenticated Information Disclosure CVSS 7.5 · 06.02.202009.08.20225.5WP Database Backup <= 5.9 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 5.5 · 09.08.202216.08.20225.5WP Database Backup <= 5.8.3 - Authenticated (Admin+) Stored Cross-Site Scripting CVSS 5.5 · 16.08.202208.01.20257.5WP Database Backup – Unlimited Database & Files Backup by Backup for WP <= 7.3 - Unauthenticated Database Back-Up Exposure CVSS 7.5 · 08.01.202501.07.20267.2WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter CVSS 7.2 · 01.07.2026

Strategic Overview

Avg CVSSHigh
7.4/ 10
Patch Coverage100%
Open

0

Fixed

14

Get automatic notifications for all WP Database Backup – Unlimited Database & Files Backup by Backup for WP vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2019-25224

WP Database Backup < 5.2 - Unauthenticated OS Command Injection

Read the full analysis

Vulnerability Records

14 records
2026-07-01 00:00CVE-2026-9834
7.2
High
Irwan KusumaYes
2025-01-08 00:00CVE-2024-12330
7.5
High
Noah Stead (TurtleBurg)Yes
2022-08-16 00:00CVE-2022-2271
5.5
Medium
Raad HaddadYes
2022-08-09 00:00N/A
5.5
Medium
AnonymousYes
2020-02-06 00:00CVE-2020-7241
7.5
High
V1n1v131r4Yes
2019-04-24 00:00CVE-2019-25224
9.8
Critical
AnonymousYes
2019-04-22 00:00CVE-2019-14949
6.1
Medium
AnonymousYes
2019-03-24 00:00N/A
9.8
Critical
AnonymousYes
2016-10-21 00:00N/A
8.8
High
TristanYes
2016-08-04 00:00CVE-2016-10874
8.8
High
AnonymousYes
Showing 1–10 of 14 reports
WP Database Backup – Unlimited Database & Files Backup by Backup for WP banner
Latestv7.13

WP Database Backup – Unlimited Database & Files Backup by Backup for WP

Backup For WP

Author

Backup For WP

4.5(102)
90/100
Last Updated
2026-08-24 (20d ago)
Active Installs
30,000+
Downloads
2,246,094
Requires WP
3.1+
Requires PHP
5.6.20+
Tested up to
WP 7.1
Created
2014-03-21 (13y ago)

WP Database Backup plugin helps you to create Database Backup and Restore Database Backup easily on single click. Manual or Automated Database Backups And also store database backup on safe place- Dropbox,FTP,Email,Google drive, Amazon S3 Features Create Database Backup WP Database Backup plugin helps you to create Database Backup easily on single click. Auto Backup – Backup automatically on a repeating schedule Website Migration – Migration Your Site with Just One Click! Download backup file direct from your WordPress dashboard Easy To Install(Very easy to use) WP Database Backup is super easy to install. Simple to configure(very less configuration), less than a minute. Restore Database Backup WP Database Backup plugin helps you to Restore Database Backup easily on single click. Multiple storage destinations Store database backup on safe place- Dropbox, Google drive, Amazon s3, FTP, sFTP, Backblaze, Email Reporting- Sends emailed backups and backup reports to any email addresses Exclude Table Database backup list pagination Search and Replace in database backup file. Search backup from list(Date/ Database Size) Sort backup list (Date/ Database Size) Save database backup file in zip format on local server And Send database backup file to destination in zip format Documentation Subscribe to Backup for WP Cloudstorage We are excited to introduce a new feature for the Backup for WP plugin , our Backup For WP Cloudstorage. Affordable Pricing: Only $1 per 50GB of storage per website per month, with a flexible pay-as-you-go model. 14-Day Free Trial: Start with a 14-day free trial to experience the benefits of cloud storage without any upfront cost. Scalable Storage: Easily adjusts to your storage needs, providing as much space as required for your backups. Secure Cloud Storage: All backups are stored securely in the cloud, protecting your data from unauthorized access Support We try our best to provide support on WordPress.org forums. However, We have a special team support where you can ask us questions and get help. Delivering a good user experience means a lot to us and so we try our best to reply each and every question that gets asked. Bug Reports Bug reports for WP Database Backup are welcomed on GitHub. Please note GitHub is not a support forum, and issues that aren’t properly qualified as bugs will be closed. Credits This plugin uses the following third-party libraries: Google APIs Client Library for PHP Author: Google URL: https://github.com/googleapis/google-api-php-client License: Apache License, Version 2.0 (the “License”) License URL: http://www.apache.org/licenses/LICENSE-2.0 PHP Secure Communications Library Author: phpseclib URL:https://github.com/phpseclib/phpseclib License: MIT License (or any other applicable license) License URL: http://opensource.org/licenses/MIT PhpConcept Library – Zip Module Author: Vincent Blavet URL:http://www.phpconcept.net License: License GNU/LGPL phpFileTree Author: Cory S.N. LaViska’s URL: https://www.abeautifulsite.net/blog/2007/06/php-file-tree/

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C