CVE-2026-104068
HighCVSS 7.2Summary
The JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability allowing an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. An attacker can craft a backup archive containing a symbolic link that extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
Risk Assessment
A WordPress administrator can exploit the flaw to write files outside the restore directory, potentially leading to server-side code execution. This can result in full compromise of the host.
Recommendation
Upgrade the JetBackup plugin to version 3.1.24.10 or later. Restrict WordPress administrative accounts and consider running restores in an isolated environment.
Other vulnerabilities in JetBackup
See all- CVE-2026-19453High
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges. This allows a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
- CVE-2026-19454Medium
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Original NVD description (English source)
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS