A vulnerability in the JetBackup WordPress plugin allows authenticated subscriber-level users to achieve full administrative access following a site migration or restore process.

This flaw, categorized as improper privilege management (CWE-269), occurs because the plugin fails to perform necessary capability checks when restoring or migrating user accounts. An attacker with subscriber-level privileges can exploit this during a site restoration process to elevate their account to administrator status.

Successful exploitation grants an attacker full administrative control over the WordPress environment. This level of access facilitates complete data compromise, unauthorized modification of site content, and potential system-wide disruption, which justifies the high CVSS score of 7.1.

Immediate Action: Update the JetBackup WordPress plugin to version 3.1.23.5 or later immediately to apply the required capability validation logic.

Proactive Monitoring: Review administrative user lists for unauthorized accounts and monitor logs for unusual activity during site migration or restoration windows.

Compensating Controls: Implement strict access control lists and verify user roles immediately following any site maintenance or migration tasks to ensure no unauthorized privilege escalation has occurred.

Public Exploit Available: Unknown

Given the potential for full administrative takeover, administrators should prioritize updating the JetBackup plugin to the patched version. Verify all user roles and permissions on your WordPress instance following the update to ensure no accounts have been modified by unauthorized parties.