Threats tagged 'ghsa-6883-v78q-c9cg'

JetBackup WordPress plugin versions before 3.1.23.5 have an authorization flaw that allows a network main site administrator, who is not a Super Admin, to download full backups of the entire multisite network including all sites' data and the shared webroot. This vulnerability arises from missing multisite authorization checks before serving backup archives and job logs.