Volver a los avisos de seguridad

JetBackup for WordPress CVE-2026-19454: Incorrect Authorization

JetBackup plugin for WordPress is affected by CVE-2026-19454. The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5. CVSS base score: 4.4.

Medium 4.4 CVSS

Versiones afectadas

before 3.1.23.5

Versión parcheada

3.1.23.5

CMD de actualización por defecto

wp plugin update jetbackup

Comandos de corrección

All supported operating systems

wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5

Lo que esto significa bajo una licencia de SharedLicense

Your SharedLicense license itself is not affected — this is a vulnerability in JetBackup plugin for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network’s main site who is not a Super Admin to download a full backup of the entire network, including every site’s data and the shared webroot.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-19454

Preguntas frecuentes

What is CVE-2026-19454?
The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5.
Is CVE-2026-19454 being exploited in the wild?
No confirmed public exploitation has been announced at the time of writing. With a CVSS base score of 4.4, apply the update on your next maintenance window and watch the vendor advisory for changes.
How do I fix CVE-2026-19454?
wp plugin update jetbackup. or: WordPress → Plugins → JetBackup → Update to 3.1.23.5.
Which versions are affected?
Affected: before 3.1.23.5. Update to 3.1.23.5 or later.

Referencias

Avisos de seguridad

Avisos relacionados

WHMCS 9.1.0 Security Update

2026-10-01

EasyApache 4 25.86 — cPanel & WHM Update

2026-10-01

LiteSpeed CVE-2026-93903

2026-09-30 00:00:00

Comprueba tu sistema en busca de vulnerabilidades

Selecciona tu producto y sistema operativo para ver los comandos de corrección exactos que se aplican a ti.

Comprueba tu sistema