Security Alert Summary
JetBackup for WordPress versions before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability. An authenticated WordPress administrator can import or restore a crafted backup archive that includes a symbolic link, causing the plugin to write attacker-controlled file contents outside the intended restore destination. Depending on writable paths and server configuration, this may lead to server-side code execution.
CVE Details
- CVE ID:
CVE-2026-104068 - Affected component: JetBackup plugin for WordPress
- Affected versions: Versions less than 3.1.24.10
- Published: October 22, 2026 at 5:16:56 PM
- Last modified: October 23, 2026 at 3:17:22 PM
- CVSS v3.1: Base score 7.2, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Requires an authenticated WordPress user with administrator-level privileges (Privileges Required: HIGH). User interaction is NONE.
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- Weakness: CWE-59 (Improper Link Resolution and Symbolic Link Handling)
Technical Details
The plugin’s backup import and restore functionality extracts archive contents and follows symbolic links contained in the archive without validating the link targets or enforcing a destination containment policy. An attacker who can supply a crafted backup archive can include a symbolic link that points outside the intended restore directory. During extraction the plugin will follow that link and write attacker-controlled file contents to the linked target path.
This behavior exists because the archive extraction process does not check or restrict where symlinks resolve, nor does it enforce that extracted files remain within the restore destination. The vulnerability therefore enables arbitrary file write operations to locations writable by the web server or PHP process.
Impact is limited by the contexts and paths the WordPress administrator can cause the plugin to write to. If the target path is web-accessible or allows execution (for example, a directory served by the web server or a location that affects PHP include paths), the attacker-controlled file contents could lead to server-side code execution. The description does not name specific functions or REST endpoints; the issue is rooted in archive extraction and missing containment/validation checks.
How This Could Impact Your Website
Consider a small team managing a WordPress site: a site owner, an internal editor who handles restores, and an external contractor who prepares backup archives. If an attacker convinces or compromises an administrator account to import a malicious backup, the attacker could cause files to be written outside the intended restore directory. In a practical scenario this might allow an attacker to place files in web-accessible locations, modify site files, or add code that can be executed by the server, increasing the risk of data exposure and further compromise.
Consequences to your site may include exposure of internal resources or user data, increased risk of targeted phishing if attackers can place pages that harvest emails, or unauthorized changes to site content. The exact impact depends on server file permissions and which directories are writable. If you re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Until an update is applied, restrict restore and import operations to a minimal set of trusted administrator accounts.
- Review and reduce unnecessary user roles, especially contributor and administrator accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and limit plugin installation privileges.
- Monitor site activity and server logs for unusual file writes, unexpected uploads, or unauthorized restores.
If you d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
