CVE-2026-9834

Name of the Vulnerable Software and Affected Versions WP Database Backup – Unlimited Database & Files Backup versions prior to 7.12

Description Authenticated attackers with administrator-level access and above can execute arbitrary operating system commands on the server, potentially leading to full remote code execution. The issue occurs because the mysqldump() function in includes/admin/class-wpdb-admin.php directly concatenates the wp db exclude table parameter into a mysqldump shell command string without using escapeshellarg(). While other arguments are escaped, the wp db exclude table values are only processed by sanitize text field() via recursive sanitize text field(), which removes HTML tags but allows shell metacharacters like ;, |, `, and $(). This is a stored injection where malicious values are saved to the WordPress options table using update option('wp db exclude table') and later executed via shell exec() during backup operations.

Recommendations Update WP Database Backup – Unlimited Database & Files Backup to version 7.12 or later. As a temporary workaround, avoid using the wp db exclude table parameter in the plugin settings until the update is applied.