CVE-2020-36669 in JetBackup Plugin
Summary
by MITRE • 03/07/2023
The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files to the vulnerable site's server via a forged request, granted they can trick a site's administrator into performing an action such as clicking on a link.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/09/2026
The JetBackup plugin for WordPress represents a critical security vulnerability classified as CVE-2020-36669, affecting versions up to and including 1.3.9. This vulnerability manifests as a cross-site request forgery weakness that undermines the plugin's security mechanisms and exposes WordPress installations to potential exploitation. The flaw specifically resides within the backup_guard_get_import_backup() function, where the absence of proper nonce validation creates a pathway for malicious actors to manipulate the backup import process. The vulnerability's classification aligns with CWE-352, which defines cross-site request forgery as a weakness where the application fails to validate the origin of requests, allowing attackers to perform unauthorized actions on behalf of authenticated users. This particular implementation flaw demonstrates a fundamental breakdown in the plugin's request validation process, where the security token that should verify legitimate user intent is completely absent from the import functionality.
The operational impact of this vulnerability extends beyond simple data manipulation, creating a potential gateway for complete system compromise. Unauthenticated attackers can leverage this weakness to upload arbitrary files to the target server, effectively transforming a simple backup import function into a file upload vector. The attack requires social engineering to trick administrators into clicking malicious links, but once executed, the consequences are severe as attackers can potentially execute malicious code, establish persistent backdoors, or gain unauthorized access to sensitive data. The vulnerability's exploitation pathway follows the ATT&CK framework's T1059.001 technique for command and scripting interpreter, as attackers can upload web shells or other malicious payloads that execute server-side commands. The security implications escalate when considering that WordPress administrators often possess elevated privileges, making successful exploitation potentially devastating for the entire web application infrastructure.
The mitigation strategies for this vulnerability must address both immediate remediation and long-term security hardening measures. The most direct solution involves updating the JetBackup plugin to version 1.3.10 or later, where nonce validation has been properly implemented in the backup_guard_get_import_backup() function. Organizations should also implement additional security layers including web application firewalls that can detect and block suspicious file upload patterns, network segmentation to limit access to backup functionality, and comprehensive monitoring of file upload activities. Security teams should conduct regular vulnerability assessments of all WordPress plugins to identify similar nonce validation gaps, particularly in functions handling file operations or user privilege changes. The implementation of proper input validation and output encoding practices, as recommended by OWASP Top Ten, would have prevented this vulnerability from existing in the first place. Additionally, administrators should enforce strict access controls and educate users about the dangers of clicking suspicious links, as the social engineering component remains a critical attack vector that cannot be entirely automated. Organizations with multiple WordPress installations should establish centralized patch management procedures to ensure all plugins receive timely security updates, preventing similar vulnerabilities from persisting across their digital infrastructure.