CVE-2026-19454
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Risk Assessment
Unauthorized access to full backups can lead to leakage of sensitive data from all sites in the network, constituting a serious security breach.
Recommendation
Update the plugin to version 3.1.23.5 or later. Restrict access to backup features to Super Admins only.
Other vulnerabilities in JetBackup
See all- CVE-2026-104068High
The JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability allowing an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. An attacker can craft a backup archive containing a symbolic link that extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
- CVE-2026-19453High
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges. This allows a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Original NVD description (English source)
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS