CVE-2026-19454CWE-863broken-access-control

CVE-2026-19454

Medium · published August 27, 2026

CVSS v3.1
4.4
EPSS
0%
Percentile
15.1
In the wild
Unconfirmed
What it is

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroot.

The record
Technical detail
CVSS v3.1
4.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00247 · 15.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-27T10:16Z
References (1)
https://wpscan.com/vulnerability/1f5480c1-260a-40ce-9938-112746f9e8e8/ · [email protected]
EPSS history
Timeline
  • 28 AUG 06:32Z
    EPSS moved — → 0%
    epss
  • 27 AUG 06:00Z
    JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download
    cvelistv5