CVE-2019-25224

CRITICAL 9.8CVE-2019-25224 · Published 25/07/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
wp database backup wpseeds	`< 5.2`	`5.2`

Description

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

References

blog.sucuri.net/2019/06/os-command-injection-in-wp-database-backup.html · Exploit
packetstormsecurity.com/files/153781 · Exploit
plugins.trac.wordpress.org/changeset/2078035/wp-database-backup · Patch
raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_db_backup_rce.rb · Exploit
wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin · Exploit
wordfence.com/threat-intel/vulnerabilities/id/d21cf285-9d75-43a2-9e81-67116f0bf896 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free