WP Database Backup < 7.12 - Admin+ OS Command Injection via wp_db_exclude_table Parameter

Description

The plugin is vulnerable to OS Command Injection via the table-exclusion setting (`wp_db_exclude_table`). The excluded-table values are concatenated directly into the `mysqldump` shell command without `escapeshellarg()` — every other argument in the same command is escaped — and are stored with only `sanitize_text_field()` applied, which does not strip shell metacharacters such as `;`, `|`, backticks, or `$()`. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary operating system commands on the server when a backup operation runs.