Arbitrary File Write Vulnerability in JetBackup Plugin for WordPress
CVE-2026-104068

8.6HIGH

Key Information:

Vendor

WordPress
Status
Jetbackup
Vendor
CVE Published:
22 October 2026

What is CVE-2026-104068?

The JetBackup plugin for WordPress, prior to version 3.1.24.10, features a critical flaw that allows authenticated administrators to write malicious content to unauthorized file locations. This occurs through a symlink-based attack initiated during the backup import and restore process. Attackers can embed symbolic links in backup archives, which the plugin then extracts without proper target validation or destination containment. Depending on server configurations and writable directories, this vulnerability could potentially enable server-side code execution, posing a severe risk to system integrity.

Affected Version(s)

JetBackup 0 < 3.1.24.10

References

https://wordpress.org/plugins/backup/#developers
release-notespatch
https://www.vulncheck.com/advisories/jetbackup-wordpress-...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sarvar Eshboyev
.