JetBackup WordPress Plugin CVE-2026-104068

Exploitation requires an authenticated WordPress administrator (CVSS PR:H) who invokes JetBackup's backup import and restore functionality with an attacker-crafted backup archive that contains a symbolic link; the archive-extraction routine must follow that symlink without validating targets or enforcing destination containment. The escalation to server-side code execution is further conditioned on the symlink target being a writable, security-relevant location (e.g., a web-executable directory) and on the server configuration permitting execution there. The principal limiting factor is the administrator privilege prerequisite - this is not remote-unauthenticated; there is no user-interaction requirement beyond the attacker's own use of the restore feature, and the flaw is fixed in version 3.1.24.10 and later.

This is a genuine but access-gated risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H) scores 8.6 and correctly reflects that the vulnerability is network-reachable and low-complexity, but PR:H means it requires an already-authenticated WordPress administrator - a privilege level that itself implies substantial control over the site. The most impactful signals agree: patch availability is confirmed from the vendor, VulnCheck reported it, and the vuln.today decision label is 'this_week' (not act_now/emergency), which matches a serious flaw that is not under active mass exploitation. No CISA KEV listing and no EPSS score were provided, so there is no evidence of in-the-wild exploitation or a quantified exploitation-probability signal - this appears to be a disclosed-and-patched issue rather than an observed campaign. The main caveat is that server-side code execution is described as conditional ('depending on the writable destination and server configuration'), so the headline RCE outcome is not guaranteed in every deployment. Net: prioritize patching within the vendor/analysis-suggested week, treat as high-impact-if-admin-compromised, but it is not a widely-automated unauthenticated threat.

An attacker who has obtained WordPress administrator access (via phishing, credential reuse, or a lower-privilege escalation) uses JetBackup's backup import and restore feature to upload a crafted backup archive containing a symbolic link. During extraction the plugin follows the symlink without validating the target or enforcing destination containment, writing attacker-controlled contents to an arbitrary path such as a web-accessible PHP file, which can yield server-side code execution where the destination is writable. No public exploit code was identified at time of analysis; a VulnCheck advisory describes the issue.