CVE-2026-75133

The Keep Backup Daily plugin for WordPress before 2.1.4 exposes a cron-processing routine (the `kbd_cron_process` parameter) without any authentication, allowing any unauthenticated remote attacker to trigger a full MySQL database dump. The generated backup is stored in the publicly accessible uploads directory, and its filename is only partially randomized (derived from the database name, a limited random range, and the current Unix timestamp), so an attacker can predict it and download the dump. A successful attack gives the attacker the complete contents of the site's database, with high confidentiality impact but no integrity or availability impact. Any WordPress site running an affected version of the plugin is exposed. There is currently no known exploitation, no public proof-of-concept, and EPSS is low (0.3%), though sites should still patch promptly since triggering the dump requires nothing more than an unauthenticated web request.

What to do: Update Keep Backup Daily to version 2.1.4 or later. If patching is delayed, restrict public access to the plugin's cron endpoint and to its backup directory under wp-content/uploads (e.g., via web server rules), and check that directory for stray .sql dump files left by earlier cron runs. Review any downloaded dumps for sensitive data (user records, password hashes, personal data) and rotate credentials if dumps were exposed on a publicly reachable site.