WordPress Plugin Vulnerabilities
JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
Description
The plugin does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Proof of Concept
Affects Plugins
Fixed in 3.1.23.5 References
CVE
Classification
Type
INCORRECT AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Akshat Parikh (SN1PER)
Submitter
Akshat Parikh (SN1PER)
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-08-25 (about 3 days ago)
Added
2026-08-25 (about 2 days ago)
Last Updated
2026-08-25 (about 2 days ago)
WPScan 