Zurück zu den Sicherheitshinweisen

JetBackup for WordPress CVE-2026-19454: Incorrect Authorization

JetBackup plugin for WordPress is affected by CVE-2026-19454. The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5. CVSS base score: 4.4.

Medium 4.4 CVSS

Betroffene Versionen

before 3.1.23.5

Gepatchte Version

3.1.23.5

Standard-Update-Befehl

wp plugin update jetbackup

Fix-Befehle

All supported operating systems

wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5

Was das unter einer SharedLicense-Lizenz bedeutet

Your SharedLicense license itself is not affected — this is a vulnerability in JetBackup plugin for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network’s main site who is not a Super Admin to download a full backup of the entire network, including every site’s data and the shared webroot.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-19454

Häufig gestellte Fragen

What is CVE-2026-19454?
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5.
Is CVE-2026-19454 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.4, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-19454?
wp plugin update jetbackup. or: WordPress → Plugins → JetBackup → Update to 3.1.23.5.
Which versions are affected?
Affected: before 3.1.23.5. Update to 3.1.23.5 or later.

Referenzen

Sicherheitshinweise

Verwandte Warnhinweise

WHMCS 9.1.0 Security Update

2026-10-01

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen