{"id":"CVE-2019-25224","aliases":["EUVD-2019-19374","GHSA-xwcj-w2w2-2g7c"],"status":"published","title":"WP Database Backup \u003c 5.2 - Unauthenticated OS Command Injection","description":"The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.22051,"percentile":0.9768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2025-07-25T02:23:58Z","modified":"2026-06-17T02:31:47Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/wp_db_backup_rce","title":"WP Database Backup RCE","type":"exploit","platform":"Linux,Windows","date":"2019-04-24","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_db_backup_rce"}],"products":[{"vendor":"databasebackup","product":"wp database backup – unlimited database \u0026 files backup by backup for wp"},{"vendor":"wpseeds","product":"wp_database_backup"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d21cf285-9d75-43a2-9e81-67116f0bf896?source=cve","tags":["Third Party Advisory"]},{"url":"https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin/","tags":["Exploit","Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/changeset/2078035/wp-database-backup","tags":["Patch"]},{"url":"https://blog.sucuri.net/2019/06/os-command-injection-in-wp-database-backup.html","tags":["Exploit","Third Party Advisory"]},{"url":"https://packetstormsecurity.com/files/153781/","tags":["Exploit","Third Party Advisory"]},{"url":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/wp_db_backup_rce.rb","tags":["Exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25224"},{"url":"https://packetstormsecurity.com/files/153781"},{"url":"https://www.wordfence.com/blog/2019/05/os-command-injection-vulnerability-patched-in-wp-database-backup-plugin"},{"url":"https://github.com/advisories/GHSA-xwcj-w2w2-2g7c"}],"sources":{"cve":[{"id":"CVE-2019-25224","title":"WP Database Backup \u003c 5.2 - Unauthenticated OS Command Injection","description":"The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.","status":"published","published":"2025-07-25T02:23:58.569Z","modified":"2026-04-08T17:25:16.491Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2019-19374","description":"The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.","status":"published","published":"2025-07-25T02:23:58Z","modified":"2026-04-08T17:25:16Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:24:39.238357Z"}],"ghsa":[{"id":"GHSA-xwcj-w2w2-2g7c","title":"The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions...","description":"The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.","status":"published","published":"2025-07-25T03:30:27Z","modified":"2025-07-25T03:30:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:03:06.773491Z"}],"nvd":[{"id":"CVE-2019-25224","description":"The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.","status":"published","published":"2025-07-25T03:15:32.69Z","modified":"2026-06-17T02:31:47.45Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:49.934131Z"}]}}