CVE-2026-19454: JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments are WordPress multisite networks using JetBackup versions before 3.1.23.5. The issue concerns access to network-wide backup archives and job logs.
What level of access does an attacker need?
An attacker needs administrator access to the multisite network's main site. They do not need to be a Super Admin.
What data could be exposed?
A qualifying main-site administrator can download a full backup of the entire multisite network. This can include data from every site and the shared webroot.
How can I determine whether this issue applies to my environment?
Verify whether the WordPress installation is a multisite network, whether JetBackup is installed, and whether its version is earlier than 3.1.23.5. Also review whether main-site administrators who are not Super Admins have been able to access backup archive or job-log downloads.