CVE-2026-4853: JetBackup Path Traversal Vulnerability

CVE-2026-4853 Overview

The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to a Path Traversal vulnerability that can lead to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This vulnerability exists due to insufficient input validation on the fileName parameter within the file upload handler, allowing authenticated attackers with administrator-level access to delete critical WordPress directories.

Critical Impact

Authenticated administrators can exploit this path traversal vulnerability to delete critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.

Affected Products

• JetBackup – Backup, Restore & Migrate plugin for WordPress versions up to and including 3.1.19.8

Discovery Timeline

• 2026-04-17 - CVE-2026-4853 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-4853

Vulnerability Analysis

This vulnerability represents a classic path traversal flaw combined with a dangerous cleanup mechanism that amplifies its impact. The JetBackup plugin's file upload handler accepts a fileName parameter that undergoes sanitization via WordPress's sanitize_text_field() function. While this function effectively removes HTML tags and certain unwanted characters, it critically fails to neutralize directory traversal sequences such as ../ (dot-dot-slash).

The vulnerability's exploitation chain involves three key components: the inadequate sanitization, unsafe path construction, and overly aggressive cleanup logic. When the unsanitized filename is passed to Upload::getFileLocation(), it is directly concatenated into the file path without utilizing PHP's basename() function or performing any validation to ensure the resolved path remains within the intended upload directory boundaries.

The most damaging aspect of this vulnerability lies in the cleanup logic. When an invalid file upload is detected, the plugin calls dirname() on the traversed path and passes the result to Util::rm(), which performs a recursive deletion of the entire resolved directory. This means an attacker can craft a malicious filename that traverses to critical WordPress directories and triggers their complete removal.

Root Cause

The root cause of this vulnerability is the improper use of sanitize_text_field() for filename sanitization combined with the absence of path canonicalization and boundary checking in Upload::getFileLocation(). The function sanitize_text_field() is designed for sanitizing general text input, not filesystem paths, and does not filter path traversal sequences. The vulnerable code directly concatenates the user-supplied filename without calling basename() to strip directory components or using realpath() to validate the final path stays within the expected directory. Additionally, the recursive deletion function Util::rm() lacks safeguards to prevent deletion of directories outside the upload scope.

Attack Vector

The attack requires network access and administrator-level authentication to the WordPress instance. An attacker with these privileges can craft a malicious file upload request with a fileName parameter containing path traversal sequences. For example, submitting a filename like ../../../wp-content/plugins/malicious.zip would cause the upload handler to resolve a path outside the intended upload directory. When the upload fails validation, the cleanup routine calculates the parent directory using dirname() and recursively deletes it via Util::rm().

The vulnerable code flow can be traced through the following locations:

• File upload handling in AddToQueue.php at lines 64 and 244 (see WordPress JetBackup Code Snippet)
• Path construction in Upload.php at line 66 (see WordPress JetBackup Code Snippet)

By manipulating the traversal depth, an attacker can target directories such as wp-content/plugins, wp-content/themes, or even the WordPress root directory, causing significant site disruption or complete failure.

Detection Methods for CVE-2026-4853

Indicators of Compromise

• Unexpected deletion of WordPress core directories such as wp-content/plugins or wp-content/themes
• Web server error logs showing missing plugin or theme files immediately after JetBackup operations
• WordPress admin dashboard errors indicating missing plugins that were previously installed
• File system audit logs showing recursive directory deletions originating from the JetBackup plugin process

Detection Strategies

• Monitor web application firewall (WAF) logs for requests to JetBackup AJAX endpoints containing ../ sequences in filename parameters
• Implement file integrity monitoring on critical WordPress directories to detect unexpected deletions
• Review PHP error logs for file operation errors related to paths outside the expected upload directory
• Audit WordPress admin activity logs for suspicious file upload operations through the JetBackup interface

Monitoring Recommendations

• Enable verbose logging for the JetBackup plugin and monitor for path-related errors
• Configure alerts for bulk file deletions in the WordPress installation directory
• Implement real-time monitoring of the wp-content directory structure for unauthorized modifications
• Set up periodic integrity checks comparing the WordPress file system against known-good baselines

How to Mitigate CVE-2026-4853

Immediate Actions Required

• Update the JetBackup plugin to the latest patched version immediately
• Review WordPress file system for any evidence of unauthorized directory deletions
• Temporarily disable the JetBackup plugin if an update is not immediately available
• Audit administrator accounts for any unauthorized access or suspicious activity

Patch Information

A security patch addressing this vulnerability is available. The fix can be reviewed in the WordPress JetBackup Changeset. Users should update to the latest version of the JetBackup plugin through the WordPress admin panel or by downloading directly from the WordPress plugin repository. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict administrator access to trusted users only, as exploitation requires administrator-level privileges
• Implement a web application firewall (WAF) rule to block requests containing path traversal sequences (../) in filename parameters
• Disable the JetBackup plugin temporarily until the patch can be applied
• Use WordPress security plugins to monitor and alert on suspicious file operations

# Example .htaccess rule to block path traversal attempts in requests
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC]
RewriteRule ^wp-admin/admin-ajax\.php - [F,L]