JetBackup plugin for WordPress before version 3.1.24.10 contains a symlink‑based arbitrary file write vulnerability that permits an authenticated administrator to write arbitrary files outside the normal restore directory during a backup import. By including a symbolic link inside the backup archive, the extraction routine follows the link without validating its target or enforcing destination containment, allowing the attacker to place controlled content anywhere that the WordPress process can write. This capability can be leveraged for server‑side code execution, data exfiltration or modification, depending on the server configuration and writable paths.

The JetBackup WordPress plugin, any version prior to 3.1.24.10, is vulnerable. Users who have installed this plugin and have administrative privileges in WordPress should validate whether they exploit the backup import feature. The affected environment is any WordPress installation that allows the plugin to run during a backup restore operation.

The vulnerability carries a CVSS score of 8.6, indicating high severity, but it is not listed in the CISA KEV catalog and its EPSS score is not available. The attack vector requires authenticated use of a WordPress administrator account to initiate a backup import, which limits the threat surface to sites with such credentials. Once accessed, the ability to write arbitrary files can lead to full compromise of the web server, and the lack of containment checks during archive extraction makes exploitation straightforward for a skilled attacker. Prompt monitoring and patching are essential.