EUVD-2026-69863
GHSA-qpph-f397-9mqv
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
PR:L for required subscriber account; UI:R and AC:H for mandatory site-owner restore trigger; C/I/A:H for full administrator-level site compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
AnalysisAI
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concurrent conditions must be satisfied: the attacker must hold an active subscriber-level (or equivalent low-privilege) account on the target WordPress site (CVSS PR:L), and the legitimate site owner must perform a site restore or migration using JetBackup (CVSS UI:R, AC:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) captures the dual nature of this vulnerability accurately: the impact is severe (full site takeover), but exploitation is gated by two simultaneous prerequisites - a subscriber-level account and a site-owner restore/migration event. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the JetBackup WordPress plugin to version 3.1.23.5 or later, which introduces proper role and capability validation during restore and migration operations. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations using JetBackup versions before 3.1.23.5, disable the plugin on non-critical sites if immediate remediation is not possible, and review recent backup restore and migration logs for evidence of unauthorized privilege escalations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in version
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in v
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today