CVE-2026-9834 is an OS command injection vulnerability in the WP Database Backup – Unlimited Database & Files Backup by Backup for WP WordPress plugin. The vulnerability arises from the direct concatenation of user-supplied wp_db_exclude_table parameter values into the mysqldump shell command string without proper escaping (escapeshellarg). Although other parameters are escaped, the exclude-table values are not, and the only filtering applied (sanitize_text_field) does not remove dangerous shell metacharacters. Authenticated users with administrator privileges can inject arbitrary commands that are stored persistently in the WordPress options table and executed during backup operations, potentially leading to full remote code execution on the server.

An attacker with administrator-level access can execute arbitrary operating system commands on the server hosting the WordPress site. This can lead to full remote code execution, compromising confidentiality, integrity, and availability of the system and data. The vulnerability affects all plugin versions up to and including 7.11.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or uninstalling the plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once released.