Database Backup for WordPress
Database Backup for WordPress has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 7 are fixed as of September 2026. Their average CVSS score is 7.4, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 3 disclosures.
The most common weakness is Missing Authorization, behind 4 of the records (57%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.
Every one of the 7 issues recorded for Database Backup for WordPress has a vendor fix available, so running the current release closes all known holes.
5 independent researchers contributed these findings, most of them (3) reported by Drew Webber (mcdruid). Database Backup for WordPress is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2022-1577Database Backup for WordPress <= 2.5.1 - Cross-Site Request Forgery to Settings Update
Read the full analysisVulnerability Records

Database Backup for WordPress
Author
WP Engine
⚠️ WARNING Database Backups for WordPress is no longer actively maintained. This software is still free to use under the license provided, but users should be aware that it is not currently maintained. No additional releases, including security releases, will be made available. Backup your database instantly, send the backup via email, or schedule backups to run automatically. Database Backup for WordPress allows you to quickly back up your core WordPress database tables, and either download the backup as a gzipped file, or send it via email to an address you choose. By default, the plugin will always back up all the core WordPress database tables. However, you may also selectively back up any custom tables that might be created by other plugins. Additional options include the ability to exclude spam comments from the comments table, or post revisions from the posts table, saving you space and bandwidth. You can also enable scheduled backups to run automatically at set intervals, and configure the email address to send the scheduled backups to. Backup Before You Mess Up Backups are the one thing you don’t think of until you need them. You might have the best web host, the most secure server, and a tried and tested process for running plugin, theme, or core updates. But all it takes is one little thing to go wrong, and you lose your entire website. You need a reliable and automated solution which backs up your WordPress data and sends it to an off-site location. Database Backup for WordPress is that solution. Why You Should Back Up Your Website As much planning as you do, any CMS like WordPress that stores its data in a database is vulnerable. Hardware, software, and security hiccups are rare, but they do happen. Even the best enterprise systems in the world have multiple levels of backup in place. Think about the data you store in your WordPress site. Your blog posts since the day you launched the site. Your customers, products, and order history if you run an ecommerce site. Backups are like implementing an insurance policy for your data. With backups, you have a reliable way of restoring that data if anything goes wrong. Simple, automated backups save you time and give you peace of mind that you are prepared for the worst case scenario, even if you never need it. Better to have it and not need it, than to not have it and suddenly need it. Scheduled Backups Depending on your needs, you might want to back up your database every few minutes, hourly, daily, weekly, or monthly. You’ll want to automate this process, or it becomes another possible point of failure. Scheduled backups give you peace of mind that your data is being backed up as much or as little as you need, without your intervention. By emailing the backups to an email address you choose, you can verify that the backup has run, and store it in a safe location. Translators Thanks to the following people for providing translation files for Database Backup for WordPress: Abel Cheung Alejandro Urrutia Alexander Kanakaris Angelo Andrea Iorio Calle Daniel Erb Daniel Villoldo Diego Pierotto Eilif Nordseth Eric Lassauge Friedlich Gilles Wittezaele Icemanpro İzzet Emre Erkan Jong-In Kim Kaveh Kessia Pinheiro Kuratkoo Majed Alotaibi Michał Gołuński Michele Spagnuolo Paopao Philippe Galliard Robert Buj Roger Rune Gulbrandsøy Serge Rauber Sergey Biryukov Tai Timm Severin Tzafrir Rehan 吴曦 Past Contributors filosofo, skippy, Firas, LaughingLizard, MtDewVirus, Podz, Ringmaster
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C