Description

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-27T06:16:57.207Z",
  "pubdate": "2026-08-27T06:16:57.207Z",
  "executiveSummary": "The JetBackup WordPress plugin is susceptible to an improper authorization vulnerability affecting versions prior to 3.1.23.5. The security flaw stems from the plugin's failure to conduct adequate multisite authorization checks when processing requests for sensitive backup archives and job logs.\nThis vulnerability specifically impacts WordPress multisite installations where network-level segregation is expected. By failing to validate the requester's 'Super Admin' status, the plugin permits an authenticated administrator of a single sub-site to access and download the full network backup.\nThe impact is critical, as it grants unauthorized access to the entire network's data, including sensitive information from every site within the multisite architecture and the shared webroot. This represents a complete failure of administrative boundary enforcement. The risk is significant because an attacker possessing standard administrator credentials for a localized site can escalate their reach to exfiltrate the totality of the hosting environment's backup files, potentially leading to total system compromise and sensitive data exposure.",
  "technicalDetails": "The root cause of this vulnerability is an authentication and authorization bypass within the JetBackup plugin's request handling logic for backup and log retrieval functions. In a WordPress multisite configuration, authorization logic must strictly verify that the user identity possesses 'Super Admin' privileges to perform actions that affect the entire network infrastructure.\nJetBackup fails to invoke the necessary capability checks (e.g., is_super_admin()) before executing server-side logic that serves file content. Consequently, the application relies on insufficient checks that do not distinguish between a network-wide Super Admin and a standard site-level administrator. When a request is made to the endpoints responsible for serving backup archives or job logs, the plugin incorrectly assumes the requester has the authority to view global system backups.\nThe exploitation flow begins with the attacker authenticating as an administrator for any site within the WordPress multisite network. Once authenticated, the attacker identifies the URI endpoints used by the JetBackup plugin to download backups or retrieve job logs. Because the application lacks a secondary authorization gate, the attacker crafts a request for a target backup archive file. Upon receiving this request, the server executes the file-serving routine without performing the required security validation, thereby streaming the contents of the requested file—which may contain the entire multisite database, user credentials, configuration files, and private uploads—directly to the attacker.\nThis vulnerability is particularly dangerous because the exposed data includes the shared webroot. Access to these files often leads to further compromise, such as the extraction of wp-config.php containing database credentials or the modification of files for persistent backdoor injection. Since the vulnerability resides within the application layer of the plugin, it is network-accessible to any authenticated site administrator. There are no complex requirements for exploitation; the vulnerability is accessible as long as the victim has valid administrative access to any site on the network and the plugin is active. The absence of strict authorization checks renders the entire multisite architecture susceptible to unauthorized exfiltration, bypassing the intended security model defined by the WordPress multisite system."
}