JetBackup vulnerabilities

The JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability allowing an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. An attacker can craft a backup archive containing a symbolic link that extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges. This allows a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.