The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in all releases up to 7.11. Malicious users with administrator or higher privileges can inject shell metacharacters into the 'wp_db_exclude_table' parameter. Because the plugin concatenates this value directly into a mysqldump call without escaping, the attacker can execute arbitrary commands on the hosting server. The vulnerability is stored: values submitted through the plugin form are saved in the options table and reused each time a backup is performed, enabling persistence.

This flaw affects every installation of the WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin running version 7.11 or older on a WordPress site. In such environments, any administrator or higher‑level role that can modify the backup settings is at risk.

The CVSS score of 7.2 marks the flaw as high severity, but the EPSS rating of 2% indicates a relatively low but non‑zero likelihood of exploitation in the wild. The vulnerability is not directly exploitable by unauthenticated users; an attacker must first acquire legitimate administrator credentials or gain elevated privileges. Once the malicious 'wp_db_exclude_table' value is stored, a subsequent backup triggers the injection, allowing the attacker to run arbitrary OS commands. The plugin is not listed in CISA’s KEV catalog.