CVE-2026-75133— Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process
Quick assessment
Affected
Fahad Mahmood Keep Backup Daily
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Keep Backup Daily 插件在 2.1.4 版本之前存在敏感信息泄露漏洞，允许未经身份验证的攻击者通过访问公开暴露的 参数来触发完整的 MySQL 数据库转储。攻击者可以根据数据库名称、有限的随机范围以及当前 Unix 时间戳，预测部分可预测的转储文件名称，从而从公开可访问的上传目录中下载生成的备份文件。
Possible ATT&CK Techniques 3 AI
T1114 · Email Collection T1213 · Data from Information Repositories T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75133
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process
Source: CVE Program / CVE List V5
Vulnerability Description
Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Fahad Mahmood | Keep Backup Daily | 0 ~ 2.1.4 | - |
|
II. Public POCs for CVE-2026-75133
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75133
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-75133 (1)
Vendor Pages for CVE-2026-75133 (1)
-
🔗 Keep Backup Daily – WordPress plugin | WordPress.org release-notes
IV. Related Vulnerabilities
Same product: Keep Backup Daily
-
CVE-2026-3577
Keep Backup Daily <= 2.1.2 - Authenticated (Admin+) Stored C -
CVE-2026-3339
Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited -
CVE-2025-26779
WordPress Keep Backup Daily plugin <= 2.1.0 - Arbitrary File -
CVE-2024-48024
WordPress Keep Backup Daily plugin <= 2.1.3 - Sensitive Data -
CVE-2022-1820
Keep Backup Daily <= 2.0.2 - Reflected Cross-Site Scripting
Same vendor: Fahad Mahmood
-
CVE-2026-28567
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Cont -
CVE-2026-57419
WordPress Stock Locations for WooCommerce plugin <= 3.1.8 - -
CVE-2026-25332
WordPress Endless Posts Navigation plugin <= 2.2.9 - Broken -
CVE-2026-24990
WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vu -
CVE-2025-69349
WordPress RSS Feed Widget plugin <= 3.0.2 - Broken Access Co
Same weakness: CWE-306
-
CVE-2026-66047
ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbit -
CVE-2026-82695
Tenda AC18 Telnet telnet missing authentication -
CVE-2026-82694
Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authen -
CVE-2026-82693
Tenda AC1206 Web UI telnet TendaTelnet missing authenticatio -
CVE-2026-58574
PowerStore关键功能缺失认证可读取系统信息
V. Comments for CVE-2026-75133
No comments yet