CVE-2026-4031 is an authorization bypass vulnerability (CWE-862) in the Database Backup for WordPress plugin by wpengine, affecting all versions up to 2.5.2. The vulnerability arises because the plugin does not restrict access to the wp_db_temp_dir parameter, which controls the directory where database backups are stored. An unauthenticated attacker can send a specially crafted request to wp-cron.php with a manipulated wp_db_temp_dir value pointing to a publicly accessible directory. If a scheduled backup runs, the backup file is saved in this location with a predictable filename, allowing the attacker to retrieve sensitive data including database credentials, password hashes, and personally identifiable information. Exploitation requires that scheduled backups are enabled by the site administrator. There is no vendor advisory or patch available at this time.

Successful exploitation leads to sensitive information exposure, including database credentials, user password hashes, and personally identifiable information. This can compromise the confidentiality of the affected WordPress site’s data. The vulnerability does not affect integrity or availability directly. Exploitation requires no privileges and no user interaction, making it a high-severity risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling scheduled backups or restricting access to wp-cron.php and the wp_db_temp_dir parameter to trusted users only. Monitoring for unusual requests to wp-cron.php may help detect exploitation attempts.