JetBackup for WordPress: Arbitrary file write via symlink (CVE-2026-104068)

JetBackup for WordPress versions prior to 3.1.24.10 contain a vulnerability where the plugin fails to sanitize symbolic links present within backup archives during the import and restore process. An authenticated WordPress administrator can craft a backup file containing a symlink that points to arbitrary locations on the host filesystem. When processed, the plugin follows these links, allowing the attacker to overwrite sensitive files or write arbitrary content to locations outside the intended restore directory, potentially resulting in server-side code execution.

Impact

Successful exploitation allows an authenticated administrator to gain arbitrary file write capabilities on the underlying server, which can be leveraged to achieve remote code execution.

Recommendation

• Update the JetBackup plugin for WordPress to version 3.1.24.10 or later immediately.
• Audit administrative user accounts within the WordPress environment to ensure that access is restricted only to trusted personnel, as this vulnerability requires administrator privileges.
• Monitor web server logs and filesystem activity for suspicious file write attempts or modifications occurring within the WordPress directory structure during manual or automated backup/restore operations.