The WP Database Backup plugin for WordPress allows authenticated attackers with administrator-level or higher privileges to inject arbitrary operating system commands. The flaw arises because the value supplied for the wp_db_exclude_table parameter is not properly escaped in the mysqldump command string, while other related arguments receive appropriate sanitization. This is a classic command injection (CWE‑77) vulnerability. The only applied filtering strips HTML tags but leaves shell metacharacters such as ;, |, `, and $() intact. This allows attackers to execute arbitrary commands when a backup operation runs, potentially leading to full remote code execution on the hosting server.

This vulnerability affects all installations of the WP Database Backup – Unlimited Database & Files Backup by Backup for WP plugin with versions 7.11 or older. Based on available information, it is inferred that the plugin is widely used within WordPress sites, and any instance that has retained settings for wp_db_exclude_table prior to the fix contains the potentially malicious value stored in the options table.

The CVSS score of 7.2 indicates a serious severity, and the EPSS score of 1.588% shows a modest likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but it provides a direct path for an attacker who can authenticate as an administrator to achieve remote code execution. The exploit requires only that the attacker has the ability to submit or modify the wp_db_exclude_table value via the plugin’s settings interface; the malicious payload is stored and later used during backup operations. An attacker could inject commands such as shell metacharacters to execute arbitrary code, read or delete files, or exfiltrate data.