CVE-2026-19454 Overview
CVE-2026-19454 affects the JetBackup WordPress plugin in versions prior to 3.1.23.5. The plugin fails to enforce multisite authorization checks before serving backup archives and job logs. An administrator of the WordPress network's main site who is not a Super Admin can download a full backup of the entire network. The exposed data includes every subsite's database, uploaded content, and the shared webroot. This constitutes a broken access control flaw that breaks the trust boundary between site administrators and network Super Admins in WordPress multisite deployments.
Critical Impact
A non-Super-Admin main-site administrator can exfiltrate full network backups containing all sites' data and shared filesystem contents.
Affected Products
- JetBackup WordPress plugin versions prior to 3.1.23.5
- WordPress multisite installations running vulnerable JetBackup releases
- Shared webroot deployments where JetBackup stores backup archives and job logs
Discovery Timeline
- 2026-08-27 - CVE-2026-19454 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-19454
Vulnerability Analysis
JetBackup exposes endpoints that serve generated backup archives and associated job logs. In a WordPress multisite context, only Super Admins should be authorized to access backups that span the entire network. The plugin's handler does not verify Super Admin capability before returning archive files or log contents. A user with the administrator role on the network's main site can request the archive and receive network-wide data. This is a broken access control issue in the multisite authorization path.
Root Cause
The root cause is a missing multisite capability check in the request handler that dispatches backup archives and job logs. The plugin appears to validate general administrator privileges but does not call the appropriate is_super_admin() or equivalent network-level check. WordPress multisite treats network-scoped resources as requiring Super Admin authorization, and the plugin does not honor this boundary.
Attack Vector
Exploitation requires an authenticated main-site administrator account. The attacker requests the backup download or log-retrieval endpoint exposed by JetBackup. The plugin serves the archive without confirming Super Admin status. The attacker receives a complete backup of the multisite network, including every subsite's wp_* tables, user records, secrets, uploaded media, and the shared webroot's PHP source and configuration files.
No verified proof-of-concept code has been published. Technical details are available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-19454
Indicators of Compromise
- Unexpected access to JetBackup download or log endpoints under /wp-admin/admin.php or /wp-admin/admin-ajax.php by non-Super-Admin accounts
- Large outbound HTTP responses originating from JetBackup archive paths correlated with main-site administrator sessions
- Backup archive files in the JetBackup storage directory being read by unexpected authenticated sessions
Detection Strategies
- Review WordPress access logs for requests to JetBackup plugin endpoints originating from users lacking Super Admin capability
- Correlate authenticated administrator sessions with anomalously large archive downloads from /wp-content/ or plugin-served download handlers
- Monitor JetBackup job log access patterns for users whose role is limited to a single site
Monitoring Recommendations
- Enable WordPress audit logging that records user role and capability for each administrative request
- Forward web server and PHP application logs to a centralized analytics platform for role-versus-endpoint correlation
- Alert on any download of a full multisite backup archive outside scheduled Super Admin activity
How to Mitigate CVE-2026-19454
Immediate Actions Required
- Update the JetBackup WordPress plugin to version 3.1.23.5 or later on all multisite installations
- Audit the list of administrators on the network's main site and remove untrusted accounts
- Rotate secrets stored in wp-config.php, database credentials, and API keys if pre-patch backup access by non-Super-Admins cannot be ruled out
Patch Information
The vendor addressed the flaw in JetBackup 3.1.23.5 by enforcing the multisite authorization check before serving backup archives and job logs. Refer to the WPScan Vulnerability Report for the fix reference.
Workarounds
- Restrict main-site administrator role assignment to users who would also qualify as Super Admins until the patch is applied
- Move JetBackup archive storage outside the shared webroot and enforce filesystem ACLs that block plugin-level file serving
- Place an authenticating reverse proxy or WAF rule in front of JetBackup endpoints to require Super Admin session validation
# Update JetBackup via WP-CLI on a multisite install
wp plugin update jetbackup --network --path=/var/www/html
wp plugin get jetbackup --field=version --path=/var/www/html
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
