What is the CVSS score of EUVD-2026-23354?

EUVD-2026-23354 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress EUVD-2026-23354

| CVE-2026-4853 MEDIUM

Path Traversal (CWE-22)

2026-04-17 Wordfence

GHSA-8cfg-qq42-h3w8

File Upload Path Traversal WordPress

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 04:41 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 04:30 euvd

EUVD-2026-23354

Analysis Generated

Apr 17, 2026 - 04:30 vuln.today

CVE Published

Apr 17, 2026 - 03:36 nvd

MEDIUM 4.9

DescriptionCVE.org

The JetBackup - Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like '../'. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.

AnalysisAI

JetBackup plugin for WordPress versions up to 3.1.19.8 allows authenticated administrators to delete arbitrary directories via path traversal in the file upload handler. The vulnerability stems from insufficient input validation on the fileName parameter, which is sanitized using sanitize_text_field() but still permits path traversal sequences like '../'. When combined with the recursive directory deletion logic in the cleanup routine, attackers can traverse outside the intended upload directory and delete critical WordPress directories such as wp-content/plugins, completely disabling all plugins and severely disrupting the WordPress installation.

Technical ContextAI

The vulnerability exists in JetBackup's Upload class, specifically in the getFileLocation() method, which concatenates user-supplied filenames directly without path validation. The plugin uses WordPress's sanitize_text_field() function, which is designed to remove HTML tags and line breaks but does not sanitize path traversal sequences. The root cause is a Path Traversal weakness (CWE-22) combined with unsafe use of dirname() and a recursive deletion function (Util::rm()) that operates on the resolved traversed path. When an invalid file is uploaded, the cleanup handler calls dirname() on the traversed path, converting a path like '/var/www/html/wp-content/plugins/../../../tmp' into '/var/www/html/wp-content', which is then passed to the recursive delete function, resulting in deletion of unintended directories.

RemediationAI

Immediately upgrade JetBackup to a version released after 3.1.19.8 that includes proper input validation and path normalization. The primary fix requires patching the Upload::getFileLocation() method to use basename() to strip any directory components from the fileName parameter, ensuring the resolved file path remains within the intended upload directory. Additionally, validate that the resolved path is within the permitted directory using functions like realpath() and verifying the resolved path is a child of the intended directory. Apply strict input validation that rejects filenames containing '../', './', or any other path traversal sequences before concatenation. As a temporary compensating control pending patching, restrict administrator role access to users who absolutely require it, or disable the JetBackup file upload functionality entirely via code modification or plugin settings if available. However, disabling uploads may impact legitimate backup operations, so this should be a temporary measure only. Monitor and audit administrator account activity, particularly around file operations, to detect suspicious activity. These controls have trade-offs: restricting admin access may impact legitimate site maintenance, and disabling uploads prevents backup functionality until patched.