CVE-2026-75133

High

Description

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable dump filename based on the database name, a limited random range, and the current Unix timestamp to download the generated backup from the publicly accessible uploads directory.

SeverityHigh

CVSS7.5

Exploit probability—

ProductKeep Backup Daily

PublishedAug 31, 2026

First seenAug 31, 2026

Weakness typeCWE-306Missing authentication for critical function

How to fix

Update

Fahad Mahmood Keep Backup Daily2.1.4 or later

Vendor advisories

wordpress.org/plugins/keep-backup-daily/#developers

Affected products

Product	Affected versions	Fixed in
Fahad Mahmood Keep Backup Daily	v < 2.1.4	2.1.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.