CVE-2026-75133: Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process
Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated database-backup disclosure?
Keep Backup Daily versions before 2.1.4 are affected when the plugin's publicly exposed kbd_cron_process parameter can be accessed. No attacker account or other authentication is required.
What does an attacker need to retrieve a backup?
An attacker can trigger a full MySQL database dump through the exposed parameter, then predict the dump filename using the database name, a limited random range, and the current Unix timestamp. The generated backup can then be downloaded from the publicly accessible uploads directory.
How can I determine whether exploitation may have occurred?
Review whether full MySQL dump files were generated in the publicly accessible uploads directory and examine access logs for requests using the kbd_cron_process parameter. Also assess whether dump filenames matching the plugin's predictable naming inputs may have been requested.