Executive brief
JetBackup is a WordPress plugin that manages site backups and archives. A flaw in its multisite authorization checks allows a site administrator (who is not a network Super Admin) to download complete network backups containing all sites' data, databases, and configuration files—including password hashes and sensitive credentials for the entire network.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in the backup download handler. The plugin fails to enforce multisite permission checks before serving backup archives and job logs, running its handler on the "init" hook without proper capability validation. An authenticated administrator of the main site—who lacks Super Admin privileges—can enumerate sequential download IDs and retrieve full network backups via GET requests without nonces or wp-admin access. The archive contains the shared database (including all user tables and every site's tables) and the entire shared webroot. The fix was released in version 3.1.23.5.
Affected products
- JetBackup JetBackup 3.1.18.8 to 3.1.23.3
Timeline
- 2026-08-25: disclosed
- 2026-08-27: patched: Fixed in version 3.1.23.5