Back to Security Advisories

JetBackup for WordPress CVE-2026-19454: Incorrect Authorization

JetBackup plugin for WordPress is affected by CVE-2026-19454. The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5. CVSS base score: 4.4.

Medium 4.4 CVSS

Affected Versions

before 3.1.23.5

Patched Version

3.1.23.5

Default Update CMD

wp plugin update jetbackup

Fix Commands

All supported operating systems

wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5

What this means under a SharedLicense license

Your SharedLicense license itself is not affected — this is a vulnerability in JetBackup plugin for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network’s main site who is not a Super Admin to download a full backup of the entire network, including every site’s data and the shared webroot.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-19454

Frequently Asked Questions

What is CVE-2026-19454?
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5.
Is CVE-2026-19454 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.4, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-19454?
wp plugin update jetbackup. or: WordPress → Plugins → JetBackup → Update to 3.1.23.5.
Which versions are affected?
Affected: before 3.1.23.5. Update to 3.1.23.5 or later.

References

Security Advisories

Related Advisories

WHMCS 9.1.0 Security Update

2026-10-01

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System