Path Traversal Vulnerability in JetBackup Plugin for WordPress

CVE-2026-4853

What is CVE-2026-4853?

The JetBackup plugin for WordPress is susceptible to a Path Traversal vulnerability due to inadequate validation of the fileName parameter in its file upload handler. This security flaw allows authenticated users with administrator access to manipulate file paths, enabling them to delete critical directories outside the intended upload directory. Essentially, attackers can exploit this vulnerability to trigger recursive deletion actions, which can incapacitate essential WordPress components, severely disrupting the website's functionality.

References