UpdraftPlus Critical Unauthenticated Auth Bypass (CVE-2026-10795) Advisory and Fix Details

Vulnerability Overview Vulnerability Name: Critical Unauthenticated Authentication Bypass Vulnerability Vulnerability Description: A critical unauthenticated bypass vulnerability exists in the UpdraftPlus WordPress plugin, allowing unauthorized attackers to execute arbitrary code by forging RPC commands. Discoverer: vtmn Report Date: June 2, 2026 Patch Date: June 5, 2026 Scope of Impact Affected Versions: UpdraftPlus WP Backup & Migration Plugin versions 1.26.4 (Free) and 2.26.5 (Premium) and below CVE ID: CVE-2026-10795 CVSS Score: 8.1 (High) Remediation Fixed Version: UpdraftPlus 1.26.5 Fix Measure: Added return value checks in the function to ensure the decrypted key is valid. Technical Details Vulnerability Principle: - The UpdraftPlus plugin processes remote communication messages via the function. - This function uses RSA to decrypt the symmetric key but does not check the decryption return value. - Attackers can craft malicious messages to exploit the default behavior upon decryption failure, obtaining a zero-filled AES key, thereby bypassing signature verification. Code Example: Disclosure Timeline June 1, 2026: Vulnerability report received June 3, 2026: Vulnerability verified and proof of concept confirmed June 4, 2026: Vendor began fixing the issue June 5, 2026: Released fixed version 1.26.5 June 12, 2026: Firewall rules updated to cover the Premium version July 3, 2026: Free version users will also receive protection Conclusion Recommendation: Immediately update the UpdraftPlus plugin to the latest version 1.26.5 to mitigate potential security risks. Additional Protection: Users of Wordfence Premium, Wordfence Care, and Wordfence Response are already protected by firewall rules. --- This summary covers the key information of the vulnerability, including the overview, scope of impact, remediation, and technical details, and provides a complete code example.

Goal Reached Thanks to every supporter — we hit 100%!

UpdraftPlus Critical Unauthenticated Auth Bypass (CVE-2026-10795) Advisory and Fix Details

More from this source