JetBackup (< 3.1.24.10) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/jetbackup--3.1.24.10/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 20:27:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgJetBackup for WordPress: Arbitrary file write via symlink (CVE-2026-104068)https://feed.craftedsignal.io/briefs/2026-10-jetbackup-symlink-rce/Thu, 22 Oct 2026 20:27:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jetbackup-symlink-rce/The JetBackup WordPress plugin before 3.1.24.10 is vulnerable to an arbitrary file write attack via malicious symbolic links in backup archives, allowing authenticated administrators to achieve remote code execution.JetBackup for WordPress versions prior to 3.1.24.10 contain a vulnerability where the plugin fails to sanitize symbolic links present within backup archives during the import and restore process. An authenticated WordPress administrator can craft a backup file containing a symlink that points to arbitrary locations on the host filesystem. When processed, the plugin follows these links, allowing the attacker to overwrite sensitive files or write arbitrary content to locations outside the intended restore directory, potentially resulting in server-side code execution.

Impact

Successful exploitation allows an authenticated administrator to gain arbitrary file write capabilities on the underlying server, which can be leveraged to achieve remote code execution.

Recommendation

  • Update the JetBackup plugin for WordPress to version 3.1.24.10 or later immediately.
  • Audit administrative user accounts within the WordPress environment to ensure that access is restricted only to trusted personnel, as this vulnerability requires administrator privileges.
  • Monitor web server logs and filesystem activity for suspicious file write attempts or modifications occurring within the WordPress directory structure during manual or automated backup/restore operations.
]]>highadvisorywordpressvulnerabilityrce