CVE-2026-4853: 
WordPress vulnerability analysis and mitigation

CVE-2026-4853 is a Path Traversal vulnerability in the JetBackup – Backup, Restore & Migrate plugin for WordPress that allows authenticated administrators to trigger arbitrary directory deletion. It affects all versions up to and including 3.1.19.8. The vulnerability was published on April 17, 2026, and carries a CVSS v3.1 base score of 4.9 (Medium) (GitHub Advisory).

The root cause is insufficient input validation (CWE-22) on the fileName parameter in the plugin's file upload handler. The plugin applies sanitize_text_field() to the fileName parameter, which strips HTML tags but does not neutralize path traversal sequences such as ../. The unsanitized value is then directly concatenated inside Upload::getFileLocation() without using basename() or verifying that the resolved path remains within the intended upload directory. When an uploaded file is deemed invalid, the cleanup logic calls dirname() on the traversed path and passes the result to Util::rm(), which recursively deletes the entire resolved directory — potentially including critical WordPress directories like wp-content/plugins (GitHub Advisory).

Relevant source references:

• AddToQueue.php (line 64 and 244): handles the upload request and passes the unsanitized fileName
• Upload.php (line 66): Upload::getFileLocation() concatenates the filename without path validation

A successful exploit allows an authenticated attacker with administrator-level access to recursively delete arbitrary directories on the WordPress server's file system. The most severe scenario involves deletion of wp-content/plugins, which disables all installed plugins and causes severe site disruption. While the CVSS score reflects high confidentiality impact and no availability impact (likely a scoring anomaly given the described behavior), the practical availability impact — complete disruption of plugin functionality — is significant for affected WordPress sites (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.019% (0.027% per GitHub Advisory), placing it in the 8th percentile for exploitation likelihood within 30 days. Exploitation requires authenticated administrator-level access, which significantly limits the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Authenticate as Administrator: Log in to the WordPress admin panel with an account holding administrator-level privileges.
2. Identify the upload endpoint: Locate the JetBackup plugin's file upload handler, accessible via the WordPress AJAX interface (e.g., wp-admin/admin-ajax.php with the appropriate action parameter targeting AddToQueue.php).
3. Craft a malicious fileName parameter: Construct a file upload request where the fileName parameter contains path traversal sequences such as ../../wp-content/plugins/target-plugin/malicious.file. The sanitize_text_field() function will not strip the ../ sequences.
4. Submit the upload request: Send the crafted request to the server. The plugin's Upload::getFileLocation() will resolve the traversed path outside the intended upload directory.
5. Trigger cleanup logic: Ensure the uploaded file is treated as invalid (e.g., wrong format or content), causing the plugin's cleanup routine to call dirname() on the resolved traversed path.
6. Achieve directory deletion: The cleanup logic passes the resolved parent directory to Util::rm(), which recursively deletes the entire directory — for example, wp-content/plugins — disabling all installed plugins and disrupting the site (GitHub Advisory).

• Logs: WordPress error logs or server access logs showing POST requests to wp-admin/admin-ajax.php with action parameters related to JetBackup upload functionality and fileName values containing ../ sequences.
• File System: Unexpected disappearance of directories under wp-content/ (e.g., wp-content/plugins/ or subdirectories thereof); missing plugin directories without corresponding uninstall actions in WordPress admin logs.
• Process/Application: WordPress admin dashboard showing all plugins as missing or deactivated without administrator action; PHP errors referencing missing plugin files following an upload event.
• Network: Authenticated HTTP POST requests to the JetBackup upload endpoint with anomalous fileName parameter values containing encoded or plain path traversal sequences (../, %2e%2e%2f, etc.) (GitHub Advisory).

Users should upgrade the JetBackup – Backup, Restore & Migrate plugin to a version newer than 3.1.19.8, as a patch has been committed to the WordPress plugin repository (changeset 3495633). As interim mitigations, restrict administrator account access to trusted users only, implement file integrity monitoring on critical WordPress directories such as wp-content/plugins, and monitor file system changes for unexpected directory deletions. Applying the principle of least privilege to WordPress administrator accounts reduces the risk of exploitation (GitHub Advisory).

Sucuri included CVE-2026-4853 in their April 2026 vulnerability patch roundup, highlighting it as a notable WordPress plugin issue requiring attention (Sucuri Blog). Wordfence also tracked the vulnerability in their threat intelligence database. Community coverage was limited given the requirement for administrator-level access, which reduces the overall risk profile compared to unauthenticated vulnerabilities.