Aller au contenu
Se connecter
4.4 Moyenne

CVE-2026-19454 The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup…

Description

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.

Produits et versions touchés

Produit Versions touchées Corrigé en
JetBackup 3.1 3.1.18.8 → < 3.1.23.5 3.1.23.5

Autres CVE de JetBackup

Les 3 CVE de JetBackup →
CVE-2026-19453 The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves… 7.1 Élevée CVE-2023-7165 The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive… 7.5 Élevée
Suivre cette CVE