WP Manifestindependent plugin directory

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/littlebizzy/export-database/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Backup your WordPress website

Changelog

2.1.1

  • added fallback token generator when random_bytes() is unavailable
  • prevents rare fatal errors on misconfigured PHP builds
  • improves reliability on hardened or restricted hosting environments

2.1.0

  • replaced direct filename-based download URLs with short-lived token downloads
  • removed .sql and file= parameters from AJAX requests to avoid firewall false positives
  • added transient-based authorization for download requests
  • switched from memory-based file loading to streamed downloads
  • improved compatibility with BBQ Firewall and hardened WordPress stacks
  • improved reliability for large database exports
  • Tested up to: bumped to 6.9

2.0.2

  • added Settings link on the plugins screen pointing to Tools > Export Database

2.0.1

  • added support for Git Updater

2.0.0

  • migrated plugin to a classic procedural architecture with minimal files
  • removed all class-based structures and legacy constants for a cleaner codebase
  • added dedicated inc/ folder with separate export and ajax handlers
  • introduced new export naming format using database name, timestamp, and random string
  • replaced automatic file deletion with a persistent export history table in the admin screen
  • added download and delete buttons for each generated file
  • improved overall security using per-request nonce validation for all ajax actions
  • redesigned admin page layout to show exports, file sizes, timestamps, and actions
  • strengthened zip and gzip handling with automatic fallbacks

1.3.1

  • added strict filesystem safety checks around all read/write/delete operations to prevent silent failures
  • hardened folder validation using new ensure_folder() to guarantee migrations directory is readable and writable
  • improved handling of corrupted or legacy migration timestamps via centralized sanitize logic
  • replaced low-level file operations with safe wrappers (safe_write, safe_read, safe_unlink) for consistent error behavior
  • added explicit readability guard to download handler to prevent 0-byte or inaccessible file downloads
  • improved admin pre-flight validation to detect permission issues before export begins
  • updated AJAX workflow to gracefully surface wp_die() errors triggered by permission or filesystem problems
  • cleaned up internal logic to minimize edge-case failures on restrictive hosting environments

1.3.0

  • fixed long-standing issue with BIT field export handling to prevent malformed SQL in certain table structures
  • cleaned up legacy AJAX routing logic and simplified initialization for improved stability
  • hardened cleanup routine to prevent warnings when removing expired migration files
  • added PHP 7.0–8.3 compatibility adjustments across core classes
  • removed redundant or outdated internal code and improved coding-standards compliance
  • minor internal refactoring to support potential future backup or migration add-ons

1.2.0

  • updated core classes for PHP 7.0–8.3 compatibility
  • replaced deprecated PHP functions including each()
  • improved sanitization and nonce handling for admin actions
  • removed deprecated &$this usage for PHP 8 compatibility
  • maintained original UI but cleaned up admin.php callbacks
  • improved stability of file writes during export and compression phases
  • implemented safe use of wp_json_encode() for migration state storage
  • note: fix to undefined BIT field handling was NOT implemented in this version despite earlier notes

1.1.0

  • tested with WP 5.0
  • updated plugin meta

1.0.9

  • updated plugin meta

1.0.8

  • added warning for Multisite installations
  • updated recommended plugins

1.0.7

  • tested with WP 4.9
  • added support for DISABLE_NAG_NOTICES

1.0.6

  • optimized plugin code
  • updated recommended plugins
  • added rating request notice

1.0.5

  • optimized plugin code

1.0.4

  • updated recommended plugins

1.0.3

  • added recommended plugins notice

1.0.2

  • tested with WP 4.8

1.0.1

  • updated plugin meta

1.0.0

  • initial release

Releases

19 releases.

Tag
Published
2.1.1 latest
Jan 14, 2026 9mo ago
Jan 13, 2026 9mo ago
Dec 29, 2025 9mo ago
Dec 3, 2025 10mo ago
Dec 3, 2025 10mo ago
Dec 2, 2025 10mo ago
Dec 2, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago
Dec 1, 2025 10mo ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

C- grade

Security

Export Database 2.1.1 · audited by WP Registry

High-severity findings.

1 high
Audited release
2.1.1
Findings
1
Worst severity
high
Content hash
e804f996147ce9702a50bcfe…

Findings

  • high Database dumps stored in a public uploads directory with no access control

    information_disclosure

    expdbs_folder() always returns wp_upload_dir()['basedir']/expdbs-migrations — a fixed, plugin-specific path under the web-served uploads tree. expdbs_ensure_folder() creates it with wp_mkdir_p() and only checks is_dir/is_writable; it never writes index.php, .htaccess (Deny from all / Require all denied / Options -Indexes), or a robots disallow, and the plugin has no nginx snippet. expdbs_do_export() then file_put_contents() a full mysqldump-style SQL file of every table matching $wpdb->base_prefix (CREATE TABLE + INSERT of every row, including wp_users.user_pass and wp_options) using a name {DB_NAME}_{Ymd_His}_{wp_generate_password(8,false)}.sql, optionally renaming to .sql.zip/.sql.gz. Changelog 2.0.0 made these files persistent (admin history table) instead of auto-deleting them. The official download path (wp_ajax_expdbs_download) is actually well built: manage_options, nonce, 128-bit token, user-id binding, basename() confinement, streamed readfile. That path is irrelevant to an unauthenticated client, who requests the static URL directly. The 8-character alphanumeric suffix (~47 bits) is not a substitute for a deny rule: the directory name is public and unique to this plugin, so autoindex, a leaked filename (admin HTML, access logs, crawlers), or a host that serves directory listings yields the entire database. Subscriber/unauth cannot trigger the write; they can read the file once an administrator has exported. Same-class issue as backup plugins that shipped without .htaccess on dump dirs (e.g. File Manager CVE-2020-24312).

    export-database.php:52-70

    Recommendation

    Do not store SQL dumps where the web server will serve them. Prefer a directory outside the document root. If they must live under uploads, then in expdbs_ensure_folder() write an index.php silence stub plus an .htaccess that denies all methods (mod_authz_core Require all denied, legacy Deny from all, Options -Indexes) and document the equivalent nginx location deny. Lengthen the random filename component (16+ bytes) and/or use a per-site random subdirectory stored as an option. Auto-expire dumps instead of keeping them indefinitely. Keep the existing manage_options + nonce + token gates on the AJAX download (already correct).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.