Total Upkeep WordPress Backup Plugin CVE-2026-3143

The wp_ajax_cli_cancel function must be registered as an unauthenticated AJAX action, allowing remote POST requests to wp-admin/admin-ajax.php without WordPress authentication. Exploitation requires that a rollback operation be actively pending on the WordPress installation-the attacker cannot trigger this state themselves, only cancel one that already exists. No special WordPress configuration is required; the vulnerable code is active in default installations of affected versions. The exploit is limited to canceling rollbacks (integrity impact only) and does not provide code execution, file access, or authentication bypass. Default WordPress installations with this plugin active are vulnerable if an update failure with automatic rollback occurs.

This vulnerability presents moderate real-world risk, despite the moderate CVSS score. The attack vector is network-accessible (AV:N) and requires no authentication (PR:N), making exploitation trivial from a technical standpoint. However, several factors limit practical impact: (1) the attack only affects systems actively performing a rollback operation-a narrow temporal window; (2) the integrity impact is confined to canceling a pending rollback, not corrupting data or gaining code execution; (3) no public exploit code or CISA KEV listing confirms widespread exploitation; (4) administrators can immediately patch by updating to version 1.17.2 or later. The CVSS score of 5.3 appropriately reflects low confidentiality/availability impact and medium integrity damage. Real-world priority depends on deployment context: sites with automatic update enabled and this plugin active during a failed update are at risk, but most WordPress installations do not have rollbacks actively pending at any given time. Security teams should treat this as a standard patch priority (not critical) but flag it for sites known to use auto-update features with this plugin.

An attacker monitors a WordPress site running Total Upkeep during a failed core update and detects that an automatic rollback has been initiated. The attacker sends an HTTP POST request to the site's wp-admin/admin-ajax.php endpoint with parameters action=cli_cancel and the appropriate CLI context, canceling the pending rollback without authentication. The WordPress installation is left in a broken state with the failed update still active, and no automatic recovery occurs, potentially causing downtime until manual intervention.