[CVE-2026-19453] The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the acco…

Descripción técnica

The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site.

Puntuación CVSS

Score: 7.1/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Debilidades (CWE)

CWE-269

Fuente oficial

Publicado en NIST NVD.