Backup Vulnerabilities

The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter...

CVSS:

4.9

Affected:

up to 3.1.19.8

Fixed in:

3.1.20.3

Disclosed:

Apr 16, 2026

CVE-2026-4853 on NVD →

[en] The JetBackup WordPress plugin before 2.0.9.9 doesn't use index files to prevent public directory listing of sensitive directories in certain configurations, which allows malicious actors to leak backup files.

Affected:

up to 2.0.9.9

Fixed in:

2.0.9.9

Disclosed:

Feb 27, 2024

CVE-2023-7165 on NVD →

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.9.7 via directory listing. This makes it possible for unauthenticated attackers to obtain backups of the database as well as other sensitive data.

CVSS:

9.8

Affected:

up to 2.0.9.7

Fixed in:

2.0.9.9

Disclosed:

Feb 2, 2024

CVE-2023-7165 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions.

Affected:

up to 1.6.9.1

Fixed in:

1.6.9.1

Disclosed:

Mar 15, 2023

CVE-2022-34148 on NVD →

[en] The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This m...

Affected:

up to 1.4.1

Fixed in:

1.4.1

Disclosed:

Mar 7, 2023

CVE-2020-36667 on NVD →

[en] The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-leve...

Affected:

up to 1.4.1

Fixed in:

1.4.1

Disclosed:

Mar 7, 2023

CVE-2020-36668 on NVD →

[en] The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary fi...

Affected:

up to 1.4.1

Fixed in:

1.4.1

Disclosed:

Mar 7, 2023

CVE-2020-36669 on NVD →

The Backup Guard plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pa...

CVSS:

5.5

Affected:

up to 1.6.9

Fixed in:

1.6.9.1

Disclosed:

Oct 27, 2022

CVE-2022-34148 on NVD →

[en] The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.

Affected:

up to 1.6.0

Fixed in:

1.6.0

Disclosed:

Apr 5, 2021

CVE-2021-24155 on NVD →

The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.

CVSS:

7.2

Affected:

up to 1.5.9

Fixed in:

1.6.0

Disclosed:

Feb 18, 2021

CVE-2021-24155 on NVD →

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to unauthorized back-up location changes in versions up to, and including 1.4.1 due to a lack of proper capability checking on the backup_guard_cloud_dropbox, backup_guard_cloud_gdrive, and backup_guard_cloud_oneDrive functions. This makes...

CVSS:

5.4

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

Jul 30, 2020

CVE-2020-36667 on NVD →

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level att...

CVSS:

4.3

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

Jul 30, 2020

CVE-2020-36668 on NVD →

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.3.9. This is due to missing nonce validation on the backup_guard_get_import_backup() function. This makes it possible for unauthenticated attackers to upload arbitrary files t...

CVSS:

8.8

Affected:

up to 1.3.9

Fixed in:

1.4.0

Disclosed:

Jul 16, 2020

CVE-2020-36669 on NVD →

[en] The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.

Affected:

up to 1.1.47

Fixed in:

1.1.47

Disclosed:

Aug 13, 2019

CVE-2017-18488 on NVD →

[en] Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

Affected:

up to 1.1.47

Fixed in:

1.1.47

Disclosed:

Aug 28, 2017

CVE-2017-10837 on NVD →

Cross-site scripting vulnerability in BackupGuard prior to version 1.1.47 allows an attacker to inject arbitrary web script or HTML via unspecified vectors.

CVSS:

6.1

Affected:

up to 1.1.46

Fixed in:

1.1.47

Disclosed:

Aug 24, 2017

CVE-2017-10837 on NVD →

The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.

CVSS:

6.1

Affected:

up to 1.1.47

Fixed in:

1.1.47

Disclosed:

Aug 11, 2017

CVE-2017-18488 on NVD →

The WordPress Backup and Migrate Plugin – Backup Guard plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the backup_guard_get_import_backup() function in versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level perm...

CVSS:

8.8

Affected:

up to 1.0.3

Fixed in:

1.0.3

Disclosed:

Feb 15, 2016

The WordPress Backup and Migrate Plugin – Backup Guard plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the backup_guard_get_import_backup() function in versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with subscriber-level perm...

Affected:

up to 1.0.3

Fixed in:

1.0.3

Disclosed:

Feb 15, 2016

The plugin allowed any authenticated user to call the AJAX actions, including the one to import backups which could lead to arbitrary file upload.

Affected:

up to 1.0.3

Fixed in:

1.0.3

Affected:

up to 2.0.9.9

Fixed in:

2.0.9.9