WordPress Plugin Vulnerabilities

JetBackup < 1.4.0 - Arbitrary File Upload via CSRF

Description

The plugin does not have CSRF checks when importing backups, allowing attackers to make logged in admin to upload arbitrary files via a CSRF attack

Affects Plugins

Plugin icon
backup
Fixed in 1.4.0

References

CVE
CVE-2020-36669

Miscellaneous

Original Researcher
Chloe Chamberland
Verified
No
WPVDB ID
89798f9f-93ef-48e5-9628-55ebfeb8be2a

Timeline

Publicly Published
2020-07-16 (about 5 years ago)
Added
2023-03-07 (about 3 years ago)
Last Updated
2023-03-07 (about 3 years ago)

Other

Published
Title
Published
2026-05-04
Title
Betheme < 28.4.1 - Authenticated (Author+) Arbitrary File Upload to Remote Code Execution via Icon Pack Upload
Published
2020-10-21
Title
Helios Solutions Brand Logo Slider <= 2.1 - Authenticated Arbitrary File Upload
Published
2016-09-19
Title
WooCommerce Product Addons < 2.0 - Arbitrary File Upload
Published
2014-08-01
Title
Shotzz - Arbitrary File Upload
Published
2026-03-03
Title
Charety < 2.0.2 - Authenticated (Subscriber+) Arbitrary File Upload