CVE-2019-25224

Critical · 9.8

CVSS

9.8

EPSS

21.8%

Published

Jul 25, 2025

CISA due date

—

The record

The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vulnerability allows unauthenticated attackers to execute arbitrary commands on the host operating system.

Affected packages

Ecosystem	Package	Introduced	Fixed