CVE-2026-75133 Fahad Mahmood CVE debrief

Who should care

Defenders responsible for WordPress installations with the Keep Backup Daily plugin should assess exposure and prioritize remediation. This includes administrators, security teams, and developers who manage WordPress plugins and databases.

Why it matters

The Keep Backup Daily plugin for WordPress before version 2.1.4 has a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump. Defenders should prioritize verifying exposure, restricting access to the `kbd_cron_process` parameter, and monitoring the uploads directory for suspicious activity.

• Verify exposure of the Keep Backup Daily plugin version and restrict access to the `kbd_cron_process` parameter to prevent unauthorized database dumps.
• Monitor the uploads directory for suspicious activity, such as unknown or unexpected backup files.
• Assess the potential impact of a database dump on the organization's data and systems.
• Verify the effectiveness of compensating controls, such as web application firewalls or intrusion detection systems, in preventing exploitation.

Technical summary

The Keep Backup Daily plugin for WordPress before version 2.1.4 contains a sensitive information exposure vulnerability. Unauthenticated attackers can trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter. The dump filename can be predicted based on the database name, a limited random range, and the current Unix timestamp, allowing attackers to download the generated backup from the publicly accessible uploads directory.

Defensive priority

Defenders should prioritize verifying exposure of the Keep Backup Daily plugin version and restricting access to the `kbd_cron_process` parameter.

Recommended defensive actions

• Verify the Keep Backup Daily plugin version and ensure it is updated to 2.1.4 or later.
• Restrict access to the `kbd_cron_process` parameter to prevent unauthorized access.
• Monitor the uploads directory for suspicious activity, such as unknown or unexpected backup files.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the corpus does not establish versions beyond 2.1.4, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.