Vulnerability Description
The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This makes it possible for unauthenticated attackers to extract sensitive data from database backup files. An index file is present, so a brute force attack would need to be successful in order to compromise any data.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-da
- https://plugins.trac.wordpress.org/browser/database-toolset/trunk/admin/class-da
- https://www.guyshavit.com/post/cve-2025-4222
- https://www.wordfence.com/threat-intel/vulnerabilities/id/fa452a9a-9e26-41a1-8de
FAQ
What is CVE-2025-4222?
CVE-2025-4222 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessible location. This ma...
How severe is CVE-2025-4222?
CVE-2025-4222 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-4222?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.