CVE-2026-19454
JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
| Vendor | unknown |
| Product | jetbackup |
| Published | Aug 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown jetbackup
Be the first to know when new unknown vulnerabilities affecting unknown jetbackup are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / JetBackup
3.1.18.8 < 3.1.23.5
References
Credits
Akshat Parikh (SN1PER) WPScan