Database Toolset <= 1.8.4 - Unauthenticated Sensitive Information Exposure via Backup Files
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-4222
- 2026-10-03 Alias added: GHSA-w988-x7hh-qmg5
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fa452a9a-9e26-41a1-8dea-4bafaf735bee?source=cve
- https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-backup.php#L76
- https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-database-toolset-admin.php#L247
- https://www.guyshavit.com/post/cve-2025-4222
More neoslab vulnerabilities
- TI-2025-02677 Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion CVSS 3.1CRITICAL 9.1
- TI-2025-23698 WordPress Database Toolset Plugin <= 1.8.4 - Arbitrary File Deletion vulnerability CVSS 3.1HIGH 8.6
Sources
- CVE-2025-4222 · CVE Program
- CVE-2025-4222 · NVD
- FIRST EPSS
- GHSA-w988-x7hh-qmg5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences