Irwan Kusuma

**Name of the Vulnerable Software and Affected Versions** WP Database Backup – Unlimited Database & Files Backup versions prior to 7.12 **Description** Authenticated attackers with administrator-level access and above can execute arbitrary operating system commands on the server, potentially leading to full remote code execution. The issue occurs because the `mysqldump()` function in `includes/admin/class-wpdb-admin.php` directly concatenates the `wp db exclude table` parameter into a `mysqldump` shell command string without using `escapeshellarg()`. While other arguments are escaped, the `wp db exclude table` values are only processed by `sanitize text field()` via `recursive sanitize text field()`, which removes HTML tags but allows shell metacharacters like `;`, `|`, `` ` ``, and `$()`. This is a stored injection where malicious values are saved to the WordPress options table using `update option('wp db exclude table')` and later executed via `shell exec()` during backup operations. **Recommendations** Update WP Database Backup – Unlimited Database & Files Backup to version 7.12 or later. As a temporary workaround, avoid using the `wp db exclude table` parameter in the plugin settings until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Login with OTP plugin for WordPress versions prior to 1.7 **Description** An authentication bypass exists due to an incomplete fix in the `otpl login action()` function. The rate-limit and lockout checks are only applied during the OTP generation phase and are not evaluated during the OTP validation phase. Additionally, the generated 6-digit OTP does not expire. This allows unauthenticated attackers to brute-force the 900,000 possible OTP values for any user account, including administrators, to obtain a valid `wp set auth cookie()` session and achieve full site compromise. **Recommendations** Update the plugin to a version later than 1.6.