CVE-2026-19454 in JetBackup Plugin
Summary
by MITRE • 08/27/2026
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/27/2026
The JetBackup WordPress plugin version 3.1.23.5 and earlier contains a critical authorization bypass vulnerability that compromises the integrity of multisite installations by allowing unauthorized access to sensitive backup archives and job logs. This flaw stems from an insufficient verification mechanism within the application logic, specifically failing to enforce strict role-based access controls before serving data files. In a WordPress Multisite environment, permissions are hierarchically structured, with Super Admins holding elevated privileges that extend across all sites in the network, while standard site administrators possess restricted rights limited to their specific subsites. The vulnerability arises because the plugin does not adequately distinguish between these roles when processing requests for backup downloads or log retrieval. Consequently, an attacker who has obtained administrative credentials for a single, non-privileged site within the network can exploit this logic error to access resources that should be strictly reserved for Super Admins.
From a technical perspective, the core issue is classified as CWE-284 Improper Access Control and CWE-306 Missing Authentication for Critical Function. The application fails to validate whether the requesting user possesses the necessary global administrative privileges before executing the file serving operation. When a request is made to download a full network backup or view job logs, the backend script processes the action without checking if the authenticated session corresponds to a Super Admin account. This oversight allows any administrator with valid credentials for any site in the multisite network to bypass security boundaries and retrieve comprehensive data dumps that include every site's database content, media files, themes, plugins, and shared webroot configurations. The absence of this check represents a fundamental failure in implementing least privilege principles within the plugin’s architecture.
The operational impact of this vulnerability is severe, as it leads directly to CWE-200 Exposure of Sensitive Information to an Unauthorized Actor. By downloading a full backup of the entire network, an attacker gains access to plaintext passwords stored in configuration files such as wp-config.php, database credentials for all subsites, and potentially sensitive user data including email addresses and personal information if included in backups. Furthermore, exposure of job logs may reveal internal server paths, file structures, and operational details that can facilitate further attacks or lateral movement within the infrastructure. Since shared webroots are often included in these archives, attackers could also obtain code from other sites on the same server, potentially identifying additional vulnerabilities across multiple applications hosted under a single multisite installation. This level of access effectively compromises the confidentiality and integrity of the entire WordPress network, not just the individual site where the attacker holds administrative rights.
To mitigate this risk, immediate action is required to update the JetBackup plugin to version 3.1.23.5 or later, which addresses these authorization checks by implementing proper role validation before serving sensitive files. Administrators should also enforce strong password policies and multi-factor authentication for all accounts with any level of administrative access within the WordPress network to reduce the likelihood of credential compromise. Additionally, reviewing server-level permissions can help limit damage if a specific site is breached; ensuring that backup storage directories have restrictive file system permissions adds an extra layer of defense independent of application logic. Regular security audits and monitoring of admin activity logs are recommended to detect any unauthorized attempts to access restricted resources, aligning with ATT&CK techniques related to Credential Access and Data Staging such as T1078 Valid Accounts and T1560 Archive Collected Data.