CVE-2026-19453
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges. This allows a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Risk Assessment
A low-privileged user can escalate to administrator, leading to full site compromise after a restore or migration operation.
Recommendation
Update the JetBackup plugin to version 3.1.23.5 or later. After restore or migration, review the roles and permissions of all user accounts.
Other vulnerabilities in JetBackup
See all- CVE-2026-104068High
The JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability allowing an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. An attacker can craft a backup archive containing a symbolic link that extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
- CVE-2026-19454Medium
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Original NVD description (English source)
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS