Security Alert Summary
The JetBackup – Backup, Restore & Migrate plugin for WordPress has a path traversal vulnerability in its file upload handler that can lead to arbitrary directory deletion when exploited. The issue is caused by insufficient validation of the fileName parameter, allowing traversal sequences to be used and resulting in recursive deletion of resolved directories during cleanup. Authenticated users with administrator-level access are reported as able to trigger this behavior.
CVE Details
- CVE ID: CVE-2026-4853
- Affected component: JetBackup – Backup, Restore & Migrate plugin for WordPress (file upload handler)
- Affected versions: versions up to and including 3.1.19.8 (as stated in the advisory)
- Published: April 17, 2026 at 05:16:18 AM
- Last modified: April 17, 2026 at 05:16:18 AM
- CVSS v3.1: Base score 4.9 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Authentication / privileges / user interaction: Authentication required; privileges required: High (administrator-level access); user interaction: None
- Primary impact (C/I/A): Confidentiality: High; Integrity: None; Availability: None (per CVSS data)
- CWE / weakness: CWE-22 (Path Traversal)
Technical Details
The vulnerability exists because the plugin performs inadequate validation of the fileName parameter in its upload handler. The code calls sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences such as "../". The unsanitized filename is then concatenated directly in Upload::getFileLocation() without using basename() or otherwise ensuring the resolved path remains inside the intended upload directory.
When an invalid or traversing filename is processed, the plugin cleanup logic calls dirname() on the traversed path and passes the result to Util::rm(), which recursively deletes the resolved directory. Because the resolved path can be outside the intended upload directory, an authenticated attacker with administrator-level access can cause deletion of critical WordPress directories, for example wp-content/plugins, disabling installed plugins and disrupting site functionality.
How This Could Impact Your Website
Consider a site with multiple users: a site owner, an internal editor or administrator, and an external contractor who has been granted admin-level access for maintenance. If an admin-level account uploads a specially crafted file name or an attacker acting with administrator privileges exploits the upload handler, the cleanup step could remove resolved directories outside the upload area. Practically, this can disable plugins (including security or backup plugins), resulting in degraded site functionality and increased risk of follow-on issues.
Disabling security or backup plugins can make it easier for other threats to affect the site and may increase the risk of data exposure or targeted social engineering attacks against staff or customers. If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially administrator and contributor accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce the attack surface.
- Monitor site activity and file system changes for unusual behavior, particularly deletions in
wp-content.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/backup/tags/3.1.17.5/src/JetBackup/Ajax/Calls/AddToQueue.php#L244
- https://plugins.trac.wordpress.org/browser/backup/tags/3.1.17.5/src/JetBackup/Ajax/Calls/AddToQueue.php#L64
- https://plugins.trac.wordpress.org/browser/backup/tags/3.1.17.5/src/JetBackup/Upload/Upload.php#L66
- https://plugins.trac.wordpress.org/browser/backup/trunk/src/JetBackup/Ajax/Calls/AddToQueue.php#L244
- https://plugins.trac.wordpress.org/browser/backup/trunk/src/JetBackup/Ajax/Calls/AddToQueue.php#L64
- https://plugins.trac.wordpress.org/browser/backup/trunk/src/JetBackup/Upload/Upload.php#L66
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3495633%40backup&new=3495633%40backup&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4aa0fa80-05dd-4fe1-b7b5-7ed0cf13053c?source=cve
