A critical sensitive information exposure vulnerability in the Keep Backup Daily WordPress plugin allows unauthenticated attackers to download the entire site database.

This flaw is a missing authentication for a critical function (CWE-306) where the kbd_cron_process parameter lacks proper access control, enabling unauthenticated remote attackers to trigger database dumps.

The exposure of a full MySQL database dump represents a catastrophic failure of data confidentiality. Attackers can gain access to user credentials, sensitive personal information, and proprietary site data, which may lead to total system compromise, identity theft, and severe regulatory non-compliance. With a CVSS score of 7.5, this vulnerability is categorized as high severity due to the ease of exploitation and the potential for complete data exfiltration.

Immediate Action: Update the Keep Backup Daily plugin to version 2.1.4 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Review web server access logs for anomalous requests to the kbd_cron_process parameter and monitor the WordPress uploads directory for unauthorized database export files.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the kbd_cron_process endpoint until the plugin can be updated.

Public Exploit Available: No

The ability for an unauthenticated user to trigger a full database backup poses an immediate risk to the integrity and confidentiality of the entire WordPress environment. Administrators should verify their plugin version and apply the 2.1.4 update as a priority. If the plugin is not actively required for site operations, removal is recommended to reduce the attack surface.