Back to Security Advisories

JetBackup for WordPress CVE-2026-19453: Improper Privilege Management

JetBackup plugin for WordPress is affected by CVE-2026-19453. The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5. CVSS base score: 7.1.

High 7.1 CVSS

Affected Versions

before 3.1.23.5

Patched Version

3.1.23.5

Default Update CMD

wp plugin update jetbackup

Fix Commands

All supported operating systems

wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a vulnerability in JetBackup plugin for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-19453

Frequently Asked Questions

What is CVE-2026-19453?
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5.
Is CVE-2026-19453 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 7.1, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-19453?
wp plugin update jetbackup. or: WordPress → Plugins → JetBackup → Update to 3.1.23.5.
Which versions are affected?
Affected: before 3.1.23.5. Update to 3.1.23.5 or later.

References

Security Advisories

Related Advisories

WHMCS 9.1.0 Security Update

2026-10-01

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System