CVE-2020-36668

MEDIUM EXPLOITED

JetBackup < 1.4.0 - Sensitive Information Exposure via backup_guard_get_manual_modal AJAX Action

Title source: llm

Exploitation Summary

CVE-2020-36668 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backup_guard_get_manual_modal function called via an AJAX action. This makes it possible for subscriber-level attackers, and above, to invoke the function and obtain database table information.

References (3)

Core 3

Core References

Release Notes

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2348984%40backup&new=2348984%40backup&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2a9d71-21ef-45a1-99ed-477066ce9620

https://www.wordfence.com/threat-intel/vulnerabilities/id/3e2a9d71-21ef-45a1-99ed-477066ce9620?source=cve

Scores

CVSS v3 4.3

EPSS 0.0064

EPSS Percentile 46.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

VulnCheck KEV 2020-07-30

CWE

CWE-200

Status published

Products (2)

backupguard/JetBackup – Backup, Restore & Migrate < 1.4.0

jetbackup/jetbackup < 1.4.0

Published Mar 07, 2023

Tracked Since Feb 18, 2026