Vulnerability · Published Sep 2, 2026 · Assigned by WPScan
CVE-2026-19453JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
High 7.1
In plain English
A high-severity privilege mismanagement in JetBackup from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 80.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/82792fbb-36b3-4a90-a7a3-ddb2573e62f2/ exploit, vdb-entry, technical-description