Unrated severityNVD Advisory· Published Jul 25, 2025· Updated Apr 8, 2026
WP Database Backup < 5.2 - Unauthenticated OS Command Injection
CVE-2019-25224
Description
The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.
Affected products
1- databasebackup/WP Database Backup – Unlimited Database & Files Backup by Backup for WPv5Range: 0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- blog.sucuri.net/2019/06/os-command-injection-in-wp-database-backup.htmlmitre
- packetstormsecurity.com/files/153781/mitre
- plugins.trac.wordpress.org/changeset/2078035/wp-database-backupmitre
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_db_backup_rce.rbmitre
- www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin/mitre
- www.wordfence.com/threat-intel/vulnerabilities/id/d21cf285-9d75-43a2-9e81-67116f0bf896mitre
News mentions
0No linked articles in our index yet.