CVE-2026-4031 is an authorization bypass vulnerability (CWE-862) in the Database Backup for WordPress plugin by wpengine, affecting all versions up to 2.5.2. The plugin fails to restrict access to the wp_db_temp_dir parameter, which controls the directory where database backups are saved. An unauthenticated attacker can send a crafted request to wp-cron.php with a manipulated wp_db_temp_dir value pointing to a publicly accessible directory. If a scheduled backup runs, the attacker can intercept the backup file before it is deleted. The backup file name is predictable, increasing the reliability of interception. The exposed backup contains sensitive data including database credentials and user password hashes. This vulnerability requires that scheduled backups are enabled by the administrator.

Successful exploitation results in sensitive information exposure, including database credentials, user password hashes, and personally identifiable information. This can lead to further compromise of the WordPress site or its users. The vulnerability does not impact integrity or availability but poses a significant confidentiality risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, administrators should consider disabling scheduled backups or restricting access to wp-cron.php and the wp_db_temp_dir parameter to trusted users only. Monitoring for unusual requests to wp-cron.php may help detect exploitation attempts.