Introduction
A critical flaw in the WPRecovery plugin lets unauthenticated attackers extract sensitive WordPress database contents and delete arbitrary files on the server. The vulnerability, tracked as CVE-2025-10726, affects all WPRecovery versions up to and including 2.0 and exposes WordPress sites to data theft and destructive attacks.
WPRecovery is a WordPress backup and recovery management plugin developed by quantumrose and distributed via Common Ninja. It is not one of the most widely deployed backup plugins, but it is designed to provide one-click restoration and backup management for WordPress sites. The plugin is currently in beta and has a limited maintenance and update history.
Technical Information
CVE-2025-10726 is a critical SQL injection vulnerability caused by improper handling of the data[id] parameter in the WPRecovery plugin. All versions up to and including 2.0 are affected. The vulnerable code path is in the plugin's backup deletion logic, in files such as delete_backup.php and the routines that build the related SQL queries.
The plugin inserts user-supplied data[id] input directly into SQL queries, without sufficient escaping and without prepared statements. Unauthenticated attackers can therefore inject arbitrary SQL commands. The plugin then passes the query result directly to PHP's unlink() function, which deletes files from the server. By manipulating the injection payload, an attacker can control the file path argument to unlink() and delete any file the web server process can access.
Relevant public code references:
As of publication, no patch or official fix is available. The vulnerability requires no authentication, and attackers can exploit it remotely.
Affected Systems and Versions
- Product: WPRecovery WordPress plugin
- Versions affected: All versions up to and including 2.0
- Vulnerable configuration: Any WordPress installation with WPRecovery plugin version 2.0 or earlier enabled
Vendor Security History
WPRecovery is developed by quantumrose and distributed via Common Ninja. The plugin is in beta and has a limited maintenance and update history. No earlier high-profile vulnerabilities are documented for this plugin. The missing patch and the beta status indicate low security maturity and limited responsiveness.
