JetBackup WordPress Plugin: Symlink-based arbitrary file write during restore
Summary
The JetBackup backup and migration plugin for WordPress follows symbolic links in a backup archive during import and restore without validating the target path. An authenticated WordPress administrator can craft a backup archive that writes attacker-controlled content outside the intended restore directory. Depending on the writable destination and server configuration, this can lead to server-side code execution.
Affected
- JetBackup plugin for WordPress before 3.1.24.10 (VulnCheck lists affected versions 0 to below 3.1.24.10)
- The 2.x branch is not verified; treat all installs below 3.1.24.10 as affected
- Unknown: whether backports exist for other release branches
Fixed in
- Update to JetBackup for WordPress 3.1.24.10 or later
Workaround
- No official workaround found. The vendor only states that the fix is available in 3.1.24.10.
Exploitation
- Not marked as known exploited in the sources reviewed; CISA KEV was not checked directly.
- A public proof-of-concept entry exists.
- CISA SSVC: exploitation none, not automatable, total technical impact.
- EPSS is about 0.6%.
- Requires administrator privileges on the WordPress site.
Our recommendation
- Update JetBackup to 3.1.24.10 or later on all WordPress sites, within the normal patch window.
- Review who holds WordPress administrator accounts and enforce strong passwords and MFA for them.
- Restore or import only backups from trusted sources.
- After any restore or import, check for unexpected symlinks and for new or changed files outside the expected paths.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
sarvarr1/jetbackup-cve
Research sources
- JetBackup – Backup, Restore & Migrate (WordPress.org) wordpress.org
- VulnCheck advisory for CVE-2026-104068 www.vulncheck.com
- JetBackup vendor blog: October security notice blog.jetbackup.com
- VulDB entry 425332 vuldb.com
- HOL Guard entry for CVE-2026-104068 hol.org
- Sploitus proof-of-concept entry sploitus.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:16.
Original description (NVD)
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. Attackers can craft a backup archive containing a symbolic link that archive extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.