Improper Role Verification in JetBackup WordPress Plugin
CVE-2026-19453
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19453?
The JetBackup plugin for WordPress, specifically versions prior to 3.1.23.5, lacks adequate checks on user role and capabilities during the restore or migration process. This flaw potentially allows users with lower privileges, such as subscribers, to escalate their access to administrator levels, compromising the security of the entire site. Upon performing a restore or migration, the absence of proper verification grants unauthorized privileges, posing a significant risk to site owners.
Affected Version(s)
JetBackup 3.1.7.9 < 3.1.23.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.