VULNERABILITY INTELLIGENCE
CVE-2026-19454
CVSS score4.4 MEDIUM
EPSS probability0.33%
CISA KEVNot currently listed
Published2026-08-27
Last modified2026-08-28
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Description
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.
Weakness classification
- CWE-863: Incorrect Authorization