CVE-2026-10795: UpdraftPlus Authentication Bypass Leading to RCE

Technical summary

The vulnerability exists in the UpdraftPlus_Remote_Communications_V2::wp_loaded function, which handles remote procedure calls (RPC) for plugin operations. The flaw stems from two compounding issues: (1) insufficient validation of remote message signatures, allowing signature verification to be bypassed, and (2) unchecked decryption return values that default to an all-zero encryption key when decryption fails. An attacker can exploit these weaknesses to forge valid-appearing RPC commands without authentication, then execute them with the privileges of the connected administrator account. This CWE-347 (Improper Verification of Cryptographic Signature) violation directly enables arbitrary plugin installation and activation, resulting in unauthenticated remote code execution (RCE).

Business impact

A successful exploit allows attackers to gain administrative control over WordPress sites running vulnerable versions of UpdraftPlus. The attacker can install backdoored plugins, modify site content, steal sensitive data, redirect traffic, or establish persistent access. For organizations relying on UpdraftPlus for backup and disaster recovery, this vulnerability is particularly concerning because it targets the backup infrastructure itself—a component typically trusted to restore sites securely. Multi-site WordPress networks and SaaS platforms hosting multiple WordPress instances face amplified risk if UpdraftPlus is deployed across many properties.

Affected systems

All versions of the UpdraftPlus: WP Backup & Migration Plugin up to and including version 1.26.4 are vulnerable. Organizations should assume any installation of UpdraftPlus at version 1.26.4 or earlier is at risk. The vulnerability affects WordPress sites on any hosting platform (shared, dedicated, cloud-based) that have the plugin installed and activated, regardless of the WordPress core version. Note that the vulnerability note does not identify a patched version; verify the latest available version against the official UpdraftPlus advisory and plugin repository.

Exploitability

This vulnerability has a moderately high barrier to exploitation (CVSS AC:H) but requires no authentication or user interaction. The attacker must craft a specially formatted remote message that passes the weakened signature check and triggers the encryption key fallback. While not a trivial attack, the requirement to forge cryptographic signatures is within the capability of a determined adversary, and the attack surface is broad—any unauthenticated network request to the WordPress site can potentially trigger the vulnerable code path. Public disclosure and research into the specific bypass techniques may lower the exploitation barrier over time.

Remediation

Update the UpdraftPlus plugin to the latest version available from the official WordPress plugin repository. WordPress site administrators should check the UpdraftPlus changelog and vendor advisory for the patched version that addresses this authentication bypass. If a patched version is not yet available at the time of reading, consider temporarily disabling or removing UpdraftPlus until a fix is released, and switch to an alternative backup plugin. Maintain regular offline backups and ensure backup restoration procedures are tested and independent of potentially compromised plugins.

Patch guidance

Monitor the official UpdraftPlus plugin page (wordpress.org/plugins/updraftplus/) and vendor advisory channels for an updated version. When a patch is released, apply it immediately as a critical priority. Test the update in a staging environment first to ensure compatibility with your WordPress configuration, custom plugins, and themes. After patching, verify that backup and migration functions continue to operate normally. If using UpdraftPlus with connected remote storage or multisite configurations, pay particular attention to any changes in the update notes related to authentication or encryption.

Detection guidance

Review web server logs for suspicious RPC requests to the WordPress site, particularly POST requests to wp-admin or REST API endpoints that might trigger the UpdraftPlus remote communications handler. Look for requests with unusual or repeated patterns that could indicate exploitation attempts. Monitor WordPress plugin activation logs (available via audit plugins or hosting provider logs) for unexpected plugin installations, especially those with suspicious or random naming. Check the site's user account logs for new administrator accounts or privilege escalations that do not correspond to known administrative actions. If UpdraftPlus is installed, examine its logs and any connected remote storage accounts for unauthorized backup operations or downloads.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity rating, the complete lack of authentication requirement, and the direct path to remote code execution via plugin installation. The authentication bypass in a backup plugin is particularly dangerous because backups are typically a last line of defense; compromise of the backup mechanism removes a critical recovery option. While the CVSS AC (Attack Complexity) score of H provides some protection, the attack is still feasible and likely to be researched publicly. Organizations using UpdraftPlus should prioritize patching before other non-critical updates.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects the combination of network-accessible attack surface (AV:N), no authentication requirement (PR:N), no user interaction (UI:N), and significant impact on confidentiality (C:H), integrity (I:H), and availability (A:H). The moderately high attack complexity (AC:H) tempers the score from critical, acknowledging that forging valid signatures requires technical sophistication. However, the potential for unauthenticated remote code execution via arbitrary plugin activation justifies a score in the critical range of business severity.

Frequently asked questions