wpengine Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

Advanced Custom Fields (ACF®)3 vulnerabilities
advanced_custom_field_pro3 vulnerabilities
Database Backup for WordPress3 vulnerabilities
wpgraphql3 vulnerabilities
advanced_custom_fields2 vulnerabilities
Better Search Replace1 vulnerability
better_search_replace1 vulnerability
Gutenberg Blocks – ACF Blocks Suite1 vulnerability
WP Migrate Lite – Migration Made Easy1 vulnerability
wp_migrate1 vulnerability

wpengine vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-4029HIGH	Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check. This makes it possible for unauthenticated attackers to export database tables, leading to Sensitive Information Exposure. Note: This vulnerability is only exploitable in WordPress Multisite environments where the deprecated is_site_admin() function exists. CWE-862May 14, 2026	CVSS7.5v3.1	EPSS0.41%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4030HIGH	Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter. This makes it possible for unauthenticated attackers to read and delete arbitrary files on the server, leading to Sensitive Information Exposure and potential site takeover. Note: This… CWE-862May 14, 2026	CVSS8.1v3.1	EPSS0.464%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-4031HIGH	Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wp_db_temp_dir parameter, which controls where database backups are written. This makes it possible for unauthenticated attackers to send a request to wp-cron.php with a poisoned wp_db_temp_dir value pointing to a publicly accessible directory (e.g., wp-content/uploads/), and if a scheduled backup is due,… CWE-862May 14, 2026	CVSS7.5v3.1	EPSS0.488%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX