The JetBackup – Backup, Restore & Migrate plugin processes the fileName parameter used during file uploads without sufficient protection against path traversal. The sanitization routine removes only HTML tags, leaving traversal sequences such as '../' intact; the resulting filename is then concatenated into the upload path and, when an invalid file is uploaded, the cleanup logic recursively deletes the resolved directory, leading to the removal of critical WordPress directories such as wp-content/plugins.

WordPress installations using the JetBackup plugin up to and including version 3.1.19.8 are affected. The vulnerability is present in all releases of the plugin packaged by BackupGuard that contain the vulnerable upload handler.

The CVSS score of 4.9 indicates medium severity, but the impact is severe because only an authenticated administrator can trigger the exploit. The lack of an EPSS score and absence from the KEV catalog suggest the vulnerability is not widely exploited yet; however, the path traversal flaw and the administrator requirement mean that if privileged users are compromised or misconfigured, the entire plugin directory and potentially other server directories can be deleted, causing site downtime and loss of functionality. Operators should treat this as a high‑risk issue within environments where administrator accounts are accessible via web or other interfaces.