The Database Backup for WordPress plugin allows an attacker to bypass authorization controls because it does not restrict the wp_db_temp_dir parameter. This flaw permits an unauthenticated user to specify a publicly accessible directory for backups. When a scheduled backup occurs, the attacker can intercept the backup file before it is cleaned up. The backup file contains the database name, table prefix, date, and swatch time, giving it a predictable name, so interception is reliable. Successful exploitation reveals sensitive database credentials, user password hashes, and personally identifiable information.

Any WordPress installation using the Database Backup for WordPress plugin version 2.5.2 or earlier is affected. The plugin vendor is wpengine under the product name 'Database Backup for WordPress'.

The CVSS score of 7.5 indicates a high severity, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires an attacker to target wp-cron.php and supply a manipulated wp_db_temp_dir value, the likely attack vector is web-based. The risk is elevated for sites that have scheduled backups configured and expose the temporary backup directory to the public.