WP Database Backup – Unlimited Database & Files Backup by Backup for WP

{
    "slug": "wp-database-backup",
    "pattern": "wpconfig_creds_string",
    "kind": "builtin",
    "version": "7.10",
    "hit_count": 10,
    "first_hit": {
        "file": "includes/admin/class-wpdbbkp-restore.php",
        "line": 180,
        "snippet": "preg_match(\"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches);"
    },
    "explanation": "plugin source contains a literal string `\"DB_NAME\"` / `\"DB_USER\"` / `\"DB_PASSWORD\"` / `\"DB_HOST\"` \u2014 the credential constants are referenced by name only when something is parsing wp-config.php to harvest the database password, which legitimate plugins essentially never do. Signature of the June 2024 credential-stuffing payload that walked the filesystem looking for wp-config files and exfiltrated DB creds. wp-config itself uses these as constants (no surrounding quotes); plugin code that quotes them is the malicious shape."
}

{
    "slug": "wp-database-backup",
    "previous_version": "7.10",
    "current_version": "7.10",
    "new_findings": [
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 180,
            "snippet": "preg_match(\"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 193,
            "snippet": "preg_match(\"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 196,
            "snippet": "preg_match(\"/'DB_USER',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 199,
            "snippet": "preg_match(\"/'DB_PASSWORD',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdbbkp-restore.php",
            "line": 202,
            "snippet": "preg_match(\"/'DB_HOST',\\s*'(.*)?'/\", $config_file, $matches);",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3096,
            "snippet": "preg_match( \"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3099,
            "snippet": "preg_match( \"/'DB_USER',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3102,
            "snippet": "preg_match( \"/'DB_PASSWORD',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3105,
            "snippet": "preg_match( \"/'DB_HOST',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        },
        {
            "pattern": "wpconfig_creds_string",
            "kind": "builtin",
            "file": "includes/admin/class-wpdb-admin.php",
            "line": 3122,
            "snippet": "preg_match( \"/'DB_NAME',\\s*'(.*)?'/\", $config_file, $matches );",
            "confidence": "high"
        }
    ],
    "new_finding_count": 10
}