Security Flaw in JetBackup Plugin for WordPress Exposes Sensitive Network Data
CVE-2026-19454
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19454?
The JetBackup plugin for WordPress prior to version 3.1.23.5 fails to properly enforce multisite authorization checks when serving backup archives and job logs. This oversight enables a network administrator—who does not possess Super Admin privileges—to download complete backups of the entire multisite network. Such unrestricted access compromises sensitive information from all sites within the network, including critical data stored in shared webroots.
Affected Version(s)
JetBackup 3.1.18.8 < 3.1.23.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.