CVE-2026-104068: JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetBackup WordPress Pluginto a version that resolves this vulnerability.Fixed in 3.1.24.10
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress administrator is required. The attacker must be able to import and restore a crafted backup archive containing a symbolic link.
Are sites using the plugin's default configuration affected?
The available information does not state whether a default configuration is affected. Exposure depends on whether an administrator can perform backup import and restore operations.
What is the likely impact of a successful exploit?
A crafted archive can cause attacker-controlled contents to be written outside the intended restore destination. This may lead to server-side code execution depending on the writable destination and server configuration.
What versions are affected?
JetBackup WordPress Plugin versions before 3.1.24.10 are affected.