CVE-2026-10795

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

No known exploitation. EPSS puts it in the 91st percentile. No fix published yet.

CVSS 3.18.1High EPSS percentile91st4.3% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-06-11Updated 2026-07-23Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

davidanderson UpdraftPlus: WP Backup & Migration PluginAffected: ≤ 1.26.4Upgrade to: after 1.26.4Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your WordPress site has UpdraftPlus installed (version 1.26.4 or earlier) with the UpdraftCentral remote communications feature turned on.
There is no fixed version available yet, so immediately disable the UpdraftCentral remote communications feature in the plugin's settings to remove the attack path.
Check your site for unexpected new admin accounts or newly installed/activated plugins, since attacks are already happening.
Keep checking for a plugin update from UpdraftPlus and install it the moment one is released.
Consider asking your host or a security plugin (e.g. a web application firewall) to block suspicious UpdraftCentral requests in the meantime.

May need vendor or contractor work

Check it yourselfA free Nuclei check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

4 publishers

Threat actors breached TeamUpdraft's infrastructure to steal UpdraftCentral keys, which they are actively using to backdoor approximately 400,000 WordPress sites.
as reported · Oct 21, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

In plain language

Written by AI from the record

A widely-used WordPress backup plugin called UpdraftPlus has a serious flaw that lets attackers take over your site without a password, and it's already being actively attacked right now — if you use this plugin, act today.

Unauthenticated attackers can bypass UpdraftPlus's UpdraftCentral remote-communications signature checks (CWE-347) by forcing a decryption failure that collapses to a predictable all-zero encryption key, allowing them to forge RPC commands and execute them as the connected administrator (e.g., installing a malicious plugin) for full RCE.

If you're affected

Full site takeover
Malicious plugin/malware installation
Customer and backup data exposure
Site used to attack others
Operational disruption from cleanup

What is it

Think of UpdraftPlus as a lock on your site's back door used for remote management by a companion dashboard. This flaw is like a trick that makes the lock accept a master key of all zeros — anyone who knows the trick can walk in without a password and start giving commands as if they were the site owner, including installing their own software.

Who is affected

This matters to you if you run a WordPress site with the UpdraftPlus: WP Backup & Migration Plugin installed, version 1.26.4 or earlier. The risk only applies if the plugin's UpdraftCentral remote communications feature is enabled — if that feature is off, this specific attack path doesn't apply, but no login or user action is needed by an attacker once it is on.

How urgent is it

This is actively being exploited right now — Wordfence reported nearly 5,000 attack attempts blocked in a single 24-hour period, confirming mass, ongoing scanning and attacks against real sites. There is no vendor patch yet, so the only effective protection today is disabling the vulnerable feature. Treat this as an urgent, same-day action item, not something to schedule for later.

What to do — in detail

Inventory all WordPress installs for the UpdraftPlus plugin and record the version; anything ≤1.26.4 is in scope.
Check plugin settings for 'UpdraftCentral' / remote communications (V2 RPC) — if enabled, this is the exposed attack surface (UpdraftPlus_Remote_Communications_V2::wp_loaded).
No fixed version has been published by the vendor as of this writing — do not rely on a patch yet. As a temporary mitigation, disable UpdraftCentral remote communications entirely, or restrict access to the relevant endpoint via firewall/WAF rules blocking unauthenticated RPC requests.
Audit for indicators of compromise: unexpected admin users, newly installed/activated plugins or themes, modified files, and outbound connections — mass exploitation has been reported by Wordfence (4,987 blocked attacks in 24 hours as of 2026-06-15).
Not in CISA KEV at this time, so there is no federal remediation deadline, but given confirmed in-the-wild exploitation treat remediation with KEV-equivalent urgency.
Monitor vendor channels and WordPress.org plugin changelog for a fix; apply it immediately once released and re-enable UpdraftCentral only after confirming the patched version.

Technical context

CVSS 3.1 8.1 (High) — AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network-reachable, no-privilege, no-interaction compromise of confidentiality, integrity and availability, with high attack complexity due to the need to trigger the decryption-collapse condition. Weakness is CWE-347 (Improper Verification of Cryptographic Signature): insufficient validation of the remote communications message format allows signature-check bypass, with unchecked decryption return values collapsing to an all-zero key, enabling forged RPC commands executed as an authenticated administrator. Not listed in CISA KEV, but NEWS findings confirm active mass exploitation (Wordfence, first reported 2026-06-15) — this confirmed exploitation outweighs the EPSS prediction (89th percentile, flat trend) for prioritization purposes. Exploit maturity: only a detection template is currently public, no full weaponized exploit code identified, though the attack itself does not require sophistication once the forged-command format is known. No patch/fixed version is currently available from the vendor.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS91st

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

4.3% chance of exploitation activity in the next 30 days, which ranks it in the 91st percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

6 events over 42 days, from the signal feeds we watch.

2026-07-23Record updated
2026-06-16Nuclei check added
2026-06-11Publishedweakness classified, att&ck mapped, record updated

Affected products

davidandersonaka updraftplus: wp backup & migration plugin, internal link juicer: seo auto linker for wordpress, all-in-one security (aios) – security and firewall
- UpdraftPlus: WP Backup & Migration PluginOn-premWeb & CMS Plugins / wordpress-plugin

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable