The Database Backup for WordPress plugin fails to enforce the return value of its authorization check, allowing unauthenticated users to trigger database exports in WordPress Multisite installations that still use the deprecated is_site_admin() function. The plugin exposes a direct export endpoint, enabling an attacker to obtain all database tables and thus confidential data, credentials, and other sensitive information. This flaw maps to CWE‑862, representing a missing or incorrect authorization policy and results in a straightforward data breach scenario.

Database Backup for WordPress plugins up to and including version 2.5.2 on WordPress Multisite installations that still support the deprecated is_site_admin() function. The CNA product identified is wpengine:Database Backup for WordPress.

The vulnerability carries a CVSS score of 7.5, indicating a high impact threat, and the EPSS score is not available, implying uncertainty about exact exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known zero‑day exploitation. Attackers can exploit the issue with a simple web request to the export endpoint, bypassing all authorization checks, which makes the risk moderate to high for sites still running the vulnerable plugin version.