CVE-2019-25224

The WP Database Backup plugin for WordPress, in all versions before 5.2, contains an unauthenticated operating system command injection flaw in its mysqldump backup function. An attacker can send a specially crafted request to the plugin's backup routine that injects arbitrary shell commands, which are executed on the server with the privileges of the web server process — typically yielding full site compromise, database theft, and a foothold for lateral movement on the host. No authentication and no user interaction are required, which is reflected in the maximum CVSS 3.1 score of 9.8 (critical). Any WordPress site running the plugin at a version prior to 5.2 is affected. Exploitation tooling is mature — a Metasploit module and multiple public writeups/PoCs exist — and EPSS scores a 21.4% probability of exploitation within 30 days (97th percentile), though the flaw is not currently on CISA's KEV list and no large-scale in-the-wild campaign is confirmed in the available data.

What to do: Upgrade WP Database Backup to version 5.2 or later immediately, or remove the plugin entirely if it is not needed. Because exploitation is unauthenticated and leaves no plugin-side login trail, review web server and database logs for unexpected requests hitting the plugin's backup/mysqldump endpoint and for spawned shell processes. If compromise is suspected, rotate database and WordPress credentials, inspect for added admin users, modified core/plugin files, webshells, and rogue cron jobs, and restore from a known-good backup.