CVE-2026-104068

JetBackup – Backup, Restore & Migrate <= 3.1.24.9 - Authenticated (Admin+) Arbitrary File Write

2026-10-22 00:00

Strategic Overview

Status: Patched in 3.1.24.10
Affected Plugin: JetBackup – Backup, Restore & Migrate
Affected Version: <= 3.1.24.9
CVSS: 4.7Medium
Weakness type: CWE-59 · Improper Link Resolution Before File Access
CVE: CVE-2026-104068

View all JetBackup – Backup, Restore & Migrate vulnerabilities

At a glance

CVE-2026-104068 is a medium-severity Improper Link Resolution Before File Access vulnerability in the JetBackup WordPress plugin, affecting versions <= 3.1.24.9. It carries a CVSS score of 4.7 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Admin level or above. The issue is fixed in version 3.1.24.10; sites on affected versions should update now. Disclosed October 2026, reported by Sarvar Eshboyev.

Vulnerability Overview

The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 3.1.24.9. This is due to missing destination-containment validation on symlink targets during archive extraction in the SYMTYPE case of the extract method, allowing symlinks pointing outside the extraction directory to be created without restriction. This makes it possible for authenticated attackers, with admin-level access and above, to write attacker-controlled file contents to arbitrary locations on the server by including a maliciously crafted symbolic link in a backup archive, potentially leading to remote code execution. The attacker must have administrator-level access to the WordPress installation and the ability to import or restore a crafted backup archive.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.

CWE-59: Improper Link Resolution Before File Access

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Remediation

Update to version 3.1.24.10, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: JetBackup 3.1.24.10 closes this, and updating the plugin is the step that ends it.

Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2026-104068 https://www.wordfence.com/threat-intel/vulnerabilities/id/e2994731-310b-4e76-9baf-7d7dff231dcc https://nvd.nist.gov/vuln/detail/CVE-2026-104068

Related records

Other vulnerabilities in JetBackup – Backup, Restore & Migrate

CVSS Vector

4.7

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Base

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredHigh
User InteractionNone
ScopeUnchanged
ConfidentialityLow
IntegrityLow
AvailabilityLow

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/