CVE-2026-75133: Missing Authentication for Critical Function in Fahad Mahmood Keep Backup Daily
Description
Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.
CVSS v4.0
Score 8.7high
Affected software
Fahad Mahmood
Keep Backup Daily
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-75133 describes a missing authentication vulnerability in the Keep Backup Daily WordPress plugin prior to version 2.1.4. An unauthenticated attacker can invoke the 'kbd_cron_process' parameter to generate a full MySQL database dump without any access control. The generated backup file is stored in the uploads directory, which is publicly accessible. The filename is partially predictable based on the database name, a limited random range, and the current Unix timestamp, enabling attackers to locate and download the backup file, exposing sensitive information.
Potential Impact
This vulnerability allows unauthenticated attackers to obtain a full backup of the WordPress site's MySQL database, potentially exposing sensitive data such as user credentials, content, and configuration details. The exposure of such data can lead to further compromise of the site and its users.
Mitigation Recommendations
A fixed version of the Keep Backup Daily plugin is available starting from version 2.1.4. Users should upgrade to version 2.1.4 or later to remediate this vulnerability. Until the upgrade is applied, restrict public access to the uploads directory and monitor for unauthorized access attempts. Patch status is confirmed by the version range indicating the fix in 2.1.4.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-17T18:39:57.661Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a95a04eacd9273b4946270b
Added to database: 08/31/2026, 15:39:58 UTC
Last enriched: 10/02/2026, 15:54:02 UTC
Last updated: 10/15/2026, 18:48:23 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.