EUVD-2026-36215
GHSA-hc7f-qwfj-7fcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify WordPress site running UpdraftPlus ≤1.26.4
-
DeliveryCraft udrpc message forcing decryption failure
-
ExploitRe-encrypt payload under all-zero key
-
InstallPOST forged RPC to plugin handler
-
C2Invoke upload_plugin and activate_plugin as admin
-
ExecuteExecute attacker PHP as WordPress process
-
ImpactEstablish persistent webshell on host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Target WordPress site must have UpdraftPlus ≤1.26.4 installed and active, with the UpdraftPlus_Remote_Communications_V2 RPC endpoint reachable over HTTP(S) (the default once the plugin is installed, regardless of whether the site is actively connected to UpdraftCentral). No authentication, no user interaction, and no prior knowledge of the legitimate RPC key are required - the bypass works because unchecked decryption return values collapse the key to all zeros, which the attacker can also use. Limiting factors: AC:H reflects the non-trivial crypto-envelope crafting needed to trigger the silent-failure path in class-udrpc2.php, sites where the plugin is installed but fully deactivated are not exposed, and WAFs that block unsigned/malformed udrpc payloads on admin-ajax.php may interfere. |
| Impact | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) correctly captures unauthenticated network exploitation with high impact, with AC:H reflecting the cryptographic-bypass craft required to construct the forged RPC envelope. There is no EPSS, KEV, or SSVC data provided, so probability and automatability cannot be quantified from input, but the vulnerability class (auth bypass leading to plugin upload on WordPress) has historically attracted mass scanning once a working exploit circulates. No public exploit is identified at time of analysis, however the Wordfence advisory plus the patched source diff on plugins.trac.wordpress.org gives a clear roadmap for exploit developers, so this should be treated as a real near-term priority rather than a theoretical high-CVSS issue. AC:H is the main mitigating factor versus a trivial AC:L bug. |
| Exploit ScenarioDerived | An attacker scans the internet for WordPress sites running UpdraftPlus ≤1.26.4, then sends a crafted POST to the site containing a udrpc message whose signature and ciphertext are constructed so that decryption silently fails and the handler falls back to the all-zero key the attacker also used to encrypt the payload. The forged RPC issues an |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 11, 2026
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticated attackers to forge RPC commands as the connected administrator by bypassing signature verification in the UpdraftPlus_Remote_Communications_V2::wp_loaded handler. A flaw in how unchecked decryption return values are handled collapses the encryption key to an all-zero value, enabling arbitrary plugin upload and activation. No public exploit identified at time of analysis, but the plugin's massive WordPress install base and trivial post-bypass impact make this a high-priority patch.
RemediationAI
Upgrade UpdraftPlus to the version released after 1.26.4 that contains the udrpc2 fix landed in WordPress plugin changeset 3561938 (https://plugins.trac.wordpress.org/changeset/3561938/updraftplus/trunk/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php); the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=cve should be consulted for the exact fixed release number, since the input data confirms an upstream fix but does not state a tagged patched version. Until you can upgrade, deactivate UpdraftPlus on internet-facing WordPress instances or, if backups must remain scheduled, disconnect the plugin from UpdraftCentral/remote control and block external POST requests to admin-ajax.php and the site root that carry the udrpc_message parameter at the WAF or reverse proxy (side effect: any legitimate remote backup orchestration will stop until the plugin is patched and reconnected). Rotate the UpdraftPlus remote-control key after patching, since the all-zero-key bypass means any previously intercepted traffic could be replayed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UpdraftPlus uses a remote procedure call (RPC) mechanism (udrpc/udrpc2) to receive backup and migration commands from a remote controller, with signed and encrypted messages intended to ensure only the paired administrator can issue commands. CWE-347 (Improper Verification of Cryptographic Signature) applies here because the wp_loaded RPC handler insufficiently validates the message envelope: when signature verification or decryption fails, the returned error/empty value is not properly checked, and downstream code coerces it into an all-zero symmetric key. With a known key, an attacker can craft a valid-looking encrypted RPC payload that the plugin processes as if it came from the legitimate administrator, including the upload_plugin and activate_plugin RPC verbs that lead to arbitrary PHP execution under the WordPress process.
Know when Updraftplus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet-reachable plugin endpoint with no auth or user interaction (AV:N/PR:N/UI:N); AC:H because forging the udrpc envelope to trigger the silent-decryption-failure path is non-trivial; full RCE gives C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Articles & Coverage 1
Executive ViewAI
UpdraftPlus, a backup plugin installed on thousands of WordPress sites, contains an unauthenticated remote code execution vulnerability (CVE-2026-10795) that allows attackers to upload and activate arbitrary plugins without any credentials, achieving complete site takeover. With no vendor patch currently available and trivial exploitation mechanics, this vulnerability creates immediate and unavoidable operational risk across affected installations.
No vendor-released patch identified at time of analysis. Interim controls: (1) Disable plugin if non-critical to business operations; (2) Implement WAF rules restricting /wp-admin/ access to authenticated users and allowlisted IP ranges; (3) Deploy file integrity monitoring to detect unauthorized plugin installations; (4) Enable WordPress audit logging with alerts for plugin activation events; (5) Maintain offline backup copies independent of UpdraftPlus.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Updraftplus
View allThe UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action functi
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugin
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the re
The WP-Optimize WordPress plugin before 3.2.13, SrbTransLatin WordPress plugin before 2.4.1 use a third-party library th
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval
Credential disclosure in the UpdraftPlus WordPress backup and migration plugin lets any authenticated user - including a
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to by
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not limit what log files to display in it's settings p
The All-In-One Security (AIOS) WordPress plugin before 5.1.5 does not escape the content of log files before outputting
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statu
The All-In-One Security (AIOS) - Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Script
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
Exploit-DB