JetBackup for WordPress CVE-2026-19453: Improper Privilege Management
JetBackup plugin for WordPress is affected by CVE-2026-19453. The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a. Affected versions: before 3.1.23.5. Fixed in 3.1.23.5. CVSS base score: 7.1.
Затронутые версии
before 3.1.23.5
Исправленная версия
3.1.23.5
Команда обновления по умолчанию
wp plugin update jetbackupКоманды исправления
All supported operating systems
wp plugin update jetbackup
# or: WordPress → Plugins → JetBackup → Update to 3.1.23.5Что это значит по лицензии SharedLicense
Your SharedLicense license itself is not affected — this is a vulnerability in JetBackup plugin for WordPress (a free WordPress plugin), not in licensing. No license action is needed; update the plugin to protect the sites running on your servers.
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-19453
Часто задаваемые вопросы
What is CVE-2026-19453?
Is CVE-2026-19453 being exploited in the wild?
How do I fix CVE-2026-19453?
Which versions are affected?
Источники
Проверьте систему на уязвимости
Выберите продукт и операционную систему, чтобы увидеть точные команды исправления.
Проверьте свою систему