Executive brief
UpdraftPlus, a popular WordPress plugin used for website backups and migrations, contains a security flaw that allows unauthorized individuals to bypass authentication. By exploiting this weakness, an attacker can gain administrative control over the website. This could lead to the installation of malicious software, theft of customer data, or complete site takeover.
Technical details
The vulnerability exists in the UpdraftPlus_Remote_Communications_V2::wp_loaded function due to improper verification of cryptographic signatures (CWE-347). Insufficient validation of the remote communications message format allows an attacker to bypass signature checks. Furthermore, unchecked decryption return values can collapse to a predictable all-zero encryption key. An unauthenticated remote attacker can exploit these flaws to forge arbitrary RPC commands. By executing these commands with administrative privileges, an attacker can upload and activate malicious plugins, ultimately achieving remote code execution (RCE). The vulnerability is addressed in versions following 1.26.4.
Affected products
- UpdraftPlus UpdraftPlus: WP Backup & Migration Plugin up to, and including, 1.26.4
Timeline
- 2026-06-11: disclosed
- 2026-06-11: advisory
References
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc.php
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php
- https://plugins.trac.wordpress.org/changeset/3561938/updraftplus/trunk/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=cve