The JetBackup – Backup, Restore & Migrate plugin for WordPress suffers from a path traversal vulnerability (CWE-22) due to improper validation of the fileName parameter in its file upload handler. The plugin uses sanitize_text_field() which removes HTML tags but does not prevent directory traversal sequences like '../'. The unsanitized filename is concatenated directly in Upload::getFileLocation() without basename() or path boundary checks. When an invalid file triggers cleanup logic, dirname() is called on the traversed path and passed to Util::rm(), recursively deleting the resolved directory. Authenticated attackers with administrator privileges can exploit this to delete critical WordPress directories such as wp-content/plugins, disabling all plugins and severely disrupting the site.

Successful exploitation allows an authenticated administrator to delete arbitrary directories outside the intended upload directory, including critical WordPress directories like wp-content/plugins. This results in disabling all installed plugins and causes severe site disruption. The CVSS score is 4.9 (medium severity) with high confidentiality impact but no integrity or availability impact indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and avoid uploading files with untrusted filenames. Monitor vendor channels for official patches or updates addressing this vulnerability.