CVE-2026-19453
JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
CVSS Score
7.1
EPSS Score
0.0%
EPSS Percentile
0th
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
| Vendor | unknown |
| Product | jetbackup |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown jetbackup
Be the first to know when new high vulnerabilities affecting unknown jetbackup are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / JetBackup
3.1.7.9 < 3.1.23.5
References
Credits
Jakub Herman WPScan