Atomic Edge analysis of CVE-2026-4030:
This vulnerability affects the Database Backup for WordPress plugin in versions up to and including 2.5.2. It allows unauthenticated attackers to read and delete arbitrary files on the server. The vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists. The CVSS score is 8.1, indicating high severity.
Root Cause: The root cause lies in the `wp-db-backup.php` file, specifically in the `can_user_backup()` method (line 1630) and the backup execution paths (lines 148-160). The `can_user_backup()` method calls `is_site_admin()` for Multisite but does not return `false` when the check fails. Instead, it only returns `false` without executing any error handling or preventing the backup process. The constructor (lines 148-160) calls `$this->can_user_backup()` without checking its return value. If it returns false, the backup operations still execute. Additionally, the vulnerable code at lines 122-126 accepted a user-controlled directory path via the `wp_db_temp_dir` GET parameter, which allowed attackers to specify an arbitrary directory for backup file placement or reading.
Exploitation: An unauthenticated attacker can send a crafted HTTP request to the WordPress installation on a Multisite instance. The request targets the plugin’s backup endpoint using the `backup` parameter. By providing a malicious `wp_db_temp_dir` parameter, the attacker can specify an arbitrary directory path. The plugin then reads or writes files from that directory without proper authorization. A typical exploit would be: GET /wp-admin/?backup=1&wp_db_temp_dir=/etc/passwd (for file read) or GET /wp-admin/?backup=1&wp_db_temp_dir=/tmp (for file deletion if combined with other parameters). The attacker does not need to be authenticated because the authorization check fails silently.
Patch Analysis: The patch makes several key changes. First, it changes all class property declarations from `var` to `private`, which limits access scope. Second, it removes the `wp_db_temp_dir` GET parameter handling entirely (lines 122-126 are deleted). This eliminates the arbitrary directory control. Third, the patch adds proper return value checking for `$this->can_user_backup()` calls (lines 148-160). Now when `can_user_backup()` returns false, the execution halts with a `return` statement. Fourth, the `can_user_backup()` method now explicitly calls `$this->error()` with a fatal error message before returning false (lines 1630-1647). Finally, the backup filename now includes a random nonce (`wp_generate_password(12, false)`) to prevent filename guessing (line 95).
Impact: Successful exploitation allows an attacker to read arbitrary files (e.g., wp-config.php containing database credentials) or delete arbitrary files on the server. File deletion can lead to site defacement, denial of service, or in combination with other vulnerabilities, remote code execution. Sensitive information exposure from file reading can enable further attacks like database access or privilege escalation.
