Database Backup for WordPress < 2.5.2 - Arbitrary Schedule Settings Update via CSRF
Priority LOW 25CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.
Summary
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
Why it matters now
EPSS 0.00425 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Database Backup for WordPress (Unknown): 2.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Database Backup for WordPress | 2.5.2 to before 2.5.2 | 2.5.2 | Patch available | CNA |
- Database Backup for WordPress VendorUnknown Affected 2.5.2 to before 2.5.2 Fixed in 2.5.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:deliciousbrains:database_backup:*:*:*:*:*:wordpress:*:* | before 2.5.2 | Vulnerable | Delicious Brains |
- cpe:2.3:a:deliciousbrains:database_backup:*:*:*:*:*:wordpress:*:* Versions before 2.5.2 Vulnerable ·Delicious Brains
Remediation
- Fix · CNA Database Backup for WordPress (Unknown) Fixed in 2.5.2
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1577
- 2026-10-03 Alias added: GHSA-r88p-mmpm-r9x8
References
More Delicious Brains Database Backup vulnerabilities
- TI-2022-00190 Database Backup for WordPress < 2.5.1 - Admin+ SQL Injection CVSS 3.1HIGH 7.2
- TI-2021-06614 Database Backup for WordPress < 2.4 - Authenticated Persistent Cross-Site Scripting (XSS) CVSS 3.1MEDIUM 5.4
Sources
- CVE-2022-1577 · CVE Program
- CVE-2022-1577 · NVD
- FIRST EPSS
- GHSA-r88p-mmpm-r9x8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences