EUVD-2026-69863
GHSA-qpph-f397-9mqv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister subscriber account on target site
-
DeliveryAwait site-owner restore or migration via JetBackup
-
ExploitPlugin restores account without role re-validation
-
ExecutionAccount elevated to WordPress administrator
-
ImpactAchieve full site compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two concurrent conditions must be satisfied: the attacker must hold an active subscriber-level (or equivalent low-privilege) account on the target WordPress site (CVSS PR:L), and the legitimate site owner must perform a site restore or migration using JetBackup (CVSS UI:R, AC:H). Neither condition alone is sufficient. Sites where subscriber-level user registration is disabled and no untrusted accounts exist are not exploitable. Sites that never use JetBackup's restore or migration functionality are similarly protected by circumstance. The attack is further limited to JetBackup versions 3.1.7.9 through pre-3.1.23.5 - sites running the patched version are not affected regardless of configuration. |
| Impact | The CVSS 7.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) captures the dual nature of this vulnerability accurately: the impact is severe (full site takeover), but exploitation is gated by two simultaneous prerequisites - a subscriber-level account and a site-owner restore/migration event. AC:H and UI:R meaningfully suppress opportunistic mass exploitation. No CISA KEV listing is present, and EPSS data is not provided in the input, so widespread active exploitation cannot be confirmed. The existence of a public PoC (WPScan) is notable and means the barrier to exploitation is low once conditions are met. Real-world risk is highest for multi-tenant or shared WordPress environments with open user registration and routine JetBackup restore workflows. Sites that disable subscriber registration and perform no restores or migrations are not realistically at risk. The CVSS score is not inflated relative to the actual impact, but the complex exploitation conditions mean it should not be treated as a simple remotely-exploitable-by-default vulnerability. |
| Exploit ScenarioDerived | An attacker registers a subscriber account on a WordPress site running JetBackup before 3.1.23.5 - a trivial step on sites with open registration. When the site owner later performs a routine backup restore or site migration using JetBackup, the plugin restores the attacker's account without re-validating its role, granting it administrator privileges. The attacker then logs in through the standard WordPress login page and has full administrative control over the site. A publicly available PoC corroborates this pathway per WPScan. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 02, 2026
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
RemediationAI
Upgrade the JetBackup WordPress plugin to version 3.1.23.5 or later, which introduces proper role and capability validation during restore and migration operations. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/82792fbb-36b3-4a90-a7a3-ddb2573e62f2/. As an immediate compensating control prior to patching, site administrators should audit and delete all untrusted subscriber-level accounts before performing any restore or migration - this eliminates the attacker's required foothold. Additionally, disabling open user registration (Settings → General → Membership in WordPress) prevents untrusted accounts from being created in the first place. These mitigations reduce attack surface but do not close the underlying flaw; patching to 3.1.23.5 is the only definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetBackup is a WordPress backup and site-migration plugin. The root cause is CWE-269 (Improper Privilege Management): during restore or migration operations, the plugin transfers account state - including roles and capabilities - from the backup set to the live site without verifying whether those roles are legitimate for the restored environment. A subscriber account recorded in a backup is thus restored with, or promoted to, administrator-level privileges on the target site. The affected version range is JetBackup 3.1.7.9 through pre-3.1.23.5 per EUVD-2026-69863. The CPE identifier cpe:2.3:a:unknown:jetbackup:*:*:*:*:*:*:*:* reflects an unresolved vendor slug in the CPE database, not an unknown product. WordPress's role model (subscriber → contributor → author → editor → administrator) makes this flaw high-impact because administrator access enables arbitrary PHP execution via plugin/theme editors, full database access, and credential harvesting.
Know when Jetbackup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
PR:L for required subscriber account; UI:R and AC:H for mandatory site-owner restore trigger; C/I/A:H for full administrator-level site compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Technical POC Analysis
Bug class: CWE-269 - Improper Privilege Management.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The JetBackup WordPress plugin (versions before 3.1.23.5) allows subscriber-level users to escalate privileges to full administrator access during site backup or migration operations. This vulnerability affects any organization using JetBackup to protect WordPress sites, creating an internal attack pathway where low-privilege accounts can gain unrestricted administrative control. Immediate patching is required to prevent unauthorized account escalation through routine backup workflows.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in version
Symlink-following arbitrary file write in the JetBackup plugin for WordPress (versions before 3.1.24.10) allows an authe
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in v
Exploit-DB