CVE-2026-19454

—

CVSS 3.1

4.4 medium

EPSS

<1%p17

Published

Aug 27, 2026 (20d ago)

Modified

Aug 28, 2026

Description

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.

Ecosystems: WordPress
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.