Description

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T06:17:16.840Z",
  "pubdate": "2026-09-02T06:17:16.840Z",
  "executiveSummary": "The JetBackup WordPress plugin, in versions prior to 3.1.23.5, contains a critical security flaw involving improper authorization during the restoration or migration process. This vulnerability allows an authenticated user with low-level privileges, specifically a subscriber, to gain unauthorized administrative access to the WordPress environment.\nThe vulnerability stems from the plugin's failure to adequately validate user roles and associated capabilities when preserving user accounts during restore or migration operations. Consequently, an attacker can leverage this oversight to escalate their privileges to an administrative level once the site administrator performs a site restoration or migration.\nThe impact of this vulnerability is severe, as it facilitates full site compromise. An attacker gaining administrative privileges can execute arbitrary code, modify site content, exfiltrate sensitive data, or install malicious plugins/backdoors. This risk is particularly high in multi-user environments where registration is enabled. No complex exploitation tools are required; the attacker simply relies on the inherent flaw in how the plugin handles user metadata during its restoration workflow.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure deserialization or preservation logic implemented by the JetBackup plugin when handling user account metadata during the restoration or migration of a WordPress site. Specifically, the plugin fails to perform a cross-check of the user's existing capabilities against the intended destination environment's security context.\nIn the context of WordPress, user roles and capabilities define the actions a user can perform. JetBackup, while attempting to migrate or restore site backups, inadvertently elevates the privilege level of accounts by failing to re-verify or strip escalated capabilities assigned to these users during the restoration process. The mechanism intended to restore the integrity of user accounts instead perpetuates or promotes user privileges regardless of their prior authorization state.\nThe attack flow proceeds as follows: First, an attacker with a subscriber-level account exists within a WordPress site instance. Second, the site administrator initiates a backup of the current site state using the vulnerable version of the JetBackup plugin. This backup includes the attacker's user metadata. Third, the administrator restores this backup to a new or existing site environment. During the restoration, the JetBackup plugin improperly applies the user metadata stored in the backup. Because the plugin does not implement role-validation logic during this phase, it inadvertently preserves or applies administrative capabilities to the attacker's account, which were either already present or incorrectly mapped during the restoration logic execution.\nOnce the restore operation is finalized, the subscriber account is granted the privileges associated with an administrator role within the context of the restored WordPress instance. The attacker, authenticated as the subscriber, can then log in and exercise full administrative control over the application. This privilege escalation is persistent because it modifies the database records defining user roles, bypassing standard WordPress capability checks. This vulnerability is not restricted to network exposure, as it depends on the site administrator's action of restoring a site, but once the condition is met, the impact is a total compromise of the WordPress management console and its underlying server environment."
}