CVE-2026-9834: WP Database Backup Plugin OS Command Injection Vulnerability

Technical summary

CVE-2026-9834 is an OS command injection vulnerability in the WP Database Backup plugin's `mysqldump()` function within `includes/admin/class-wpdb-admin.php`. The flaw occurs because the `wp_db_exclude_table` parameter, derived from `$_POST['wp_db_exclude_table']`, is concatenated directly into a shell command string passed to `shell_exec()` without wrapping in `escapeshellarg()`. Although the plugin applies `sanitize_text_field()` to the input, this function only strips HTML tags and leaves shell metacharacters (`;`, `|`, backtick, `$()`) intact. Notably, every other argument to the same `mysqldump` command (database user, password, host, output filename, and database name) is properly escaped, making the table exclusion parameter the sole unprotected vector. The injected payload is stored persistently in the WordPress options table via `update_option()` and executed whenever a backup runs, enabling stored command injection.

Business impact

An administrator with malicious intent, or an attacker who compromises an administrative account, can execute arbitrary commands on the hosting server. This leads to full remote code execution (RCE), enabling data theft, website defacement, malware installation, lateral movement within the network, and server compromise. The stored nature of the injection means the attack persists across multiple backup cycles unless the malicious configuration is removed. Organizations relying on this plugin for critical database backups face exposure of database contents and potential loss of backup integrity.

Affected systems

WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin for WordPress in all versions up to and including 7.11 is affected. Any WordPress installation with this plugin active and an administrator or higher-privileged user account is at risk. The vulnerability requires administrative access to exploit, limiting the attack surface to trusted insiders or accounts compromised through phishing, credential stuffing, or other account takeover techniques.

Exploitability

Exploitation requires administrator-level or above access to the WordPress installation, making this a privilege-escalation vector rather than a unauthenticated remote code execution. However, administrator compromise is common in real-world incidents through social engineering, weak credentials, or supply-chain attacks targeting plugin/theme developers. Once admin access is obtained, exploitation is trivial: an attacker simply navigates to the plugin settings, enters shell metacharacters and commands in the table exclusion field (e.g., `table; id > /var/www/html/pwned.txt`), saves the settings, and triggers a backup. Commands execute with the web server's privileges. The CVSS 3.1 score of 7.2 (HIGH) reflects the high impact but accounts for the requirement of high privilege level.

Remediation

Update the WP Database Backup plugin to a patched version as soon as it becomes available. Until a patch is released, restrict administrative access strictly to trusted users, monitor admin activity logs, and consider temporarily disabling the plugin if it is not actively in use. Implement strong password policies, enforce multi-factor authentication on admin accounts, and audit existing WordPress options table entries for suspicious `wp_db_exclude_table` values that contain shell metacharacters.

Patch guidance

Verify the latest version of WP Database Backup available on the official WordPress plugin repository. The plugin vendor should release a patch that wraps the `wp_db_exclude_table` parameter in `escapeshellarg()` to neutralize shell metacharacters. Apply the update immediately in a staging environment to test for compatibility with your WordPress version, themes, and other plugins, then deploy to production. Monitor backup logs post-patch to confirm normal operation.

Detection guidance

Search the WordPress options table (`wp_options`) for the option name `wp_db_exclude_table` and inspect its stored value for shell metacharacters (`;`, `|`, backtick, `$()`, `&&`, `||`, newlines). Enable WordPress audit logging to track changes to plugin settings and options. Monitor web server logs and process execution logs for unexpected `mysqldump` or shell commands spawned from the PHP process. Set up alerts on admin user login and settings page access. Query database and file integrity monitoring (FIM) tools for unauthorized modifications to `wp-content/plugins/wp-db-backup/` or backup output files.

Why prioritize this

Although the CVSS score is 7.2 (HIGH), priority depends on your organization's WordPress security posture. Prioritize this if: (a) you use the WP Database Backup plugin, (b) multiple users have admin access, or (c) your admin accounts have weak security practices. It is lower priority in environments with strict admin access controls, MFA enforcement, and robust account monitoring. Given the stored injection nature and RCE potential, however, even limited-scope deployments warrant prompt patching.

Risk score, explained

CVSS 3.1 Base Score of 7.2 (HIGH) is justified by: Attack Vector (Network) – the vulnerability is exploitable over the network via HTTP POST; Attack Complexity (Low) – no special conditions required once admin access is obtained; Privileges Required (High) – administrative access is mandatory; User Interaction (None) – no user click-through needed; Scope (Unchanged) – impact is limited to the affected system; Confidentiality (High) – an attacker can read sensitive files and database contents; Integrity (High) – arbitrary file writes and command execution enable system alteration; Availability (High) – an attacker can crash services or delete data. The high privilege requirement prevents a perfect 9.0+ CVSS, but the combination of network exploitability and RCE potential with high impact justifies the HIGH severity rating.

Frequently asked questions