The vulnerability resides in the Keep Backup Daily WordPress plugin before version 2.1.4. An unauthenticated user can invoke the publicly exposed kbd_cron_process parameter and request a full MySQL database dump. Because the system does not enforce authentication, attackers can obtain a backup file that contains all database tables, user credentials, and site content. The flaw is a lack of authentication (CWE‑306), enabling a thief to gain full confidentiality of the entire database.

The affected product is the Keep Backup Daily plugin for WordPress, available from Fahad Mahmood. All installations running any version earlier than 2.1.4 are vulnerable. The plug‑in is typically included in WordPress sites that use it for automatic backups.

The CVSS score is 8.7, reflecting a highly severe confidentiality impact. The EPSS score is not available, so it is unclear how frequently attackers are attempting exploitation at this time; however, the flaw is easy to trigger via a simple HTTP request, and the output files are stored in the publicly accessible uploads directory. The vulnerability is not listed in the CISA KEV catalog. Because the attack does not require authentication and the backup file names can be predicted from the database name, timestamp, and a limited random range, a determined attacker can repeatedly obtain backups without needing credentials.