Executive brief
JetBackup is a WordPress backup and migration plugin used by site administrators to protect and transfer website data. The plugin fails to validate user permissions when restoring or migrating sites, allowing a low-privilege subscriber account to be granted administrator access. An attacker with a subscriber account can exploit this during a site restoration to gain full administrative control and compromise the website.
Technical details
The vulnerability is a privilege escalation (CWE-269: Improper Access Control) affecting JetBackup versions 3.1.7.9 through 3.1.23.3. When a site owner performs a restore or migration operation, the plugin preserves user accounts but fails to verify their original roles or capabilities before assigning administrator privileges. A subscriber-level user can leverage this flaw to gain administrator access if present in a backup that is restored to the site. The attack requires a backup restoration or migration action by the site owner, and is fixed in version 3.1.23.5.
Affected products
- Jetsoftware JetBackup 3.1.7.9 through 3.1.23.3
Timeline
- 2026-08-31: disclosed: Publicly disclosed on WPScan
- 2026-09-02: patched: Fixed in version 3.1.23.5
- 2026-09-30: other: Proof of concept to be published