What is the CVSS score of CVE-2026-3143?

CVE-2026-3143 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Total Upkeep WordPress Backup Plugin CVE-2026-3143

EUVD-2026-26502 MEDIUM

Missing Authorization (CWE-862)

2026-05-01 Wordfence

Authentication Bypass WordPress

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 14:00 vuln.today

EUVD ID Assigned

May 01, 2026 - 13:45 euvd

EUVD-2026-26502

Analysis Generated

May 01, 2026 - 13:45 vuln.today

CVE Published

May 01, 2026 - 13:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Total Upkeep - WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.

AnalysisAI

Unauthenticated attackers can cancel pending rollbacks in Total Upkeep WordPress Backup Plugin by BoldGrid (versions up to 1.17.1) due to missing capability checks on the wp_ajax_cli_cancel AJAX function, allowing malicious users to prevent automatic recovery from failed WordPress updates. CVSS 5.3 (network-accessible, low complexity) reflects the integrity impact and lack of authentication requirement, though real-world impact depends on whether rollback operations are actively pending during an update failure.

Technical ContextAI

Total Upkeep is a WordPress plugin providing backup, restore, and automatic rollback functionality for failed WordPress updates. The vulnerability exists in the wp_ajax_cli_cancel AJAX handler, which processes requests to cancel pending rollback operations without verifying the user has the required WordPress capability (typically manage_options). WordPress AJAX endpoints (wp-admin/admin-ajax.php) are publicly accessible but should implement nonce verification and capability checks to restrict actions to authorized administrators. This is a classic missing authorization check (CWE-862: Missing Authorization) in a WordPress plugin's AJAX callback. The affected function is registered as an unauthenticated AJAX action, meaning any remote user can invoke it by sending a POST request to the WordPress admin-ajax endpoint with the action parameter set to 'cli_cancel'.

RemediationAI

Vendor-released patch: Total Upkeep version 1.17.2 or later includes a capability check on the wp_ajax_cli_cancel function to restrict cancellation of rollbacks to authenticated administrators. Update the plugin immediately via WordPress admin dashboard (Plugins > Installed Plugins > Total Upkeep > Update) or via WP-CLI with 'wp plugin update boldgrid-backup'. For sites unable to update immediately, implement a Web Application Firewall (WAF) rule to block POST requests to wp-admin/admin-ajax.php with the action parameter 'cli_cancel', though this has the trade-off of potentially blocking legitimate administrative cancellations during troubleshooting. Additionally, restrict access to wp-admin/admin-ajax.php to known IP ranges if the site is in a controlled environment. See Wordfence vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/f25dcd7e-8fb1-471e-bd22-782409de45c4?source=cve for patch confirmation.