Jetbackup
Monthly
Symlink-following arbitrary file write in the JetBackup plugin for WordPress (versions before 3.1.24.10) allows an authenticated WordPress administrator to write attacker-chosen file contents outside the intended restore destination by importing a crafted backup archive that contains a symbolic link. Because the extraction routine follows the link without validating targets or enforcing destination containment, the write can land in a security-relevant location and, where the server configuration permits execution there, escalate to server-side code execution. The administrator-level privilege prerequisite (CVSS PR:H) is the main limiter on exposure; exploitation requires no victim interaction beyond the attacker's own use of the import/restore feature, no public exploit was identified at time of analysis, and the vendor has released a fixed version (3.1.24.10).
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.
Symlink-following arbitrary file write in the JetBackup plugin for WordPress (versions before 3.1.24.10) allows an authenticated WordPress administrator to write attacker-chosen file contents outside the intended restore destination by importing a crafted backup archive that contains a symbolic link. Because the extraction routine follows the link without validating targets or enforcing destination containment, the write can land in a security-relevant location and, where the server configuration permits execution there, escalate to server-side code execution. The administrator-level privilege prerequisite (CVSS PR:H) is the main limiter on exposure; exploitation requires no victim interaction beyond the attacker's own use of the import/restore feature, no public exploit was identified at time of analysis, and the vendor has released a fixed version (3.1.24.10).
Privilege escalation in the JetBackup WordPress plugin before 3.1.23.5 allows a subscriber-level user to gain full administrator access by exploiting the plugin's failure to validate account roles during a site restore or migration. When the site owner performs a legitimate backup restore or migration, JetBackup blindly preserves and promotes accounts in the backup set without re-verifying their roles or capabilities, silently elevating an attacker's low-privilege account to administrator. A publicly available proof-of-concept exists per WPScan, though no confirmed mass exploitation (CISA KEV) is on record; the CVSS 7.1 score (AC:H/UI:R) reflects real-world complexity imposed by the site-owner trigger.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The JetBackup - WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Missing Authorization vulnerability could allow attackers to access resources or perform actions without proper authorization checks.