CVE-2020-36668 in JetBackup Plugin
Summary
by MITRE • 03/07/2023
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The JetBackup WordPress plugin vulnerability CVE-2020-36668 represents a critical access control flaw that undermines the security posture of WordPress installations. This vulnerability exists within the plugin's backup_guard_get_manual_modal function which is exposed through an AJAX endpoint without proper authentication checks. The flaw allows attackers with subscriber-level privileges or higher to exploit the function and extract sensitive database table information that should remain restricted to authorized administrators. The vulnerability directly impacts the confidentiality aspect of the information security triad by enabling unauthorized data disclosure that could reveal critical system architecture details.
The technical implementation of this vulnerability stems from insufficient capability validation within the AJAX handler mechanism. When the backup_guard_get_manual_modal function is invoked through the wp_ajax_backup_guard_get_manual_modal action, the plugin fails to verify whether the requesting user possesses the necessary administrative privileges. This omission creates an attack vector where malicious actors can craft specific AJAX requests to access database schema information, potentially exposing table names, column structures, and other sensitive metadata. The vulnerability is classified as a weakness in authorization mechanisms under CWE-285, specifically related to insufficient authorization checks in web applications.
The operational impact of this vulnerability extends beyond simple information disclosure to potentially enable more sophisticated attacks. Attackers who can obtain database table information gain valuable intelligence for planning subsequent exploitation attempts, including identifying potential injection points, understanding data relationships, and mapping out system architecture. This information disclosure can facilitate advanced persistent threats where attackers use the gathered metadata to craft more targeted attacks against the WordPress installation. The vulnerability affects all versions up to and including 1.4.0, representing a significant risk for WordPress sites that have not updated to newer versions.
Security practitioners should implement immediate mitigations including updating to the patched version of the JetBackup plugin and reviewing access controls for all WordPress plugins. Organizations should conduct thorough vulnerability assessments to identify any other plugins with similar authorization flaws and ensure proper capability checking is implemented across all AJAX endpoints. The vulnerability aligns with ATT&CK technique T1213.002 for Data from Databases and T1083 for File and Directory Discovery, as attackers can leverage this flaw to gather system information and database structures. Additionally, this vulnerability demonstrates the importance of implementing principle of least privilege for AJAX handlers and ensuring that all user interactions with backend systems are properly authenticated and authorized.