EUVD-2026-36215
GHSA-hc7f-qwfj-7fcf
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet-reachable plugin endpoint with no auth or user interaction (AV:N/PR:N/UI:N); AC:H because forging the udrpc envelope to trigger the silent-decryption-failure path is non-trivial; full RCE gives C:H/I:H/A:H.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Articles & Coverage 1
AnalysisAI
Remote code execution in UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions ≤1.26.4) allows unauthenticated attackers to forge RPC commands as the connected administrator by bypassing signature verification in the UpdraftPlus_Remote_Communications_V2::wp_loaded handler. A flaw in how unchecked decryption return values are handled collapses the encryption key to an all-zero value, enabling arbitrary plugin upload and activation. No public exploit identified at time of analysis, but the plugin's massive WordPress install base and trivial post-bypass impact make this a high-priority patch.
Technical ContextAI
UpdraftPlus uses a remote procedure call (RPC) mechanism (udrpc/udrpc2) to receive backup and migration commands from a remote controller, with signed and encrypted messages intended to ensure only the paired administrator can issue commands. CWE-347 (Improper Verification of Cryptographic Signature) applies here because the wp_loaded RPC handler insufficiently validates the message envelope: when signature verification or decryption fails, the returned error/empty value is not properly checked, and downstream code coerces it into an all-zero symmetric key. With a known key, an attacker can craft a valid-looking encrypted RPC payload that the plugin processes as if it came from the legitimate administrator, including the upload_plugin and activate_plugin RPC verbs that lead to arbitrary PHP execution under the WordPress process.
RemediationAI
Upgrade UpdraftPlus to the version released after 1.26.4 that contains the udrpc2 fix landed in WordPress plugin changeset 3561938 (https://plugins.trac.wordpress.org/changeset/3561938/updraftplus/trunk/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php); the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=cve should be consulted for the exact fixed release number, since the input data confirms an upstream fix but does not state a tagged patched version. Until you can upgrade, deactivate UpdraftPlus on internet-facing WordPress instances or, if backups must remain scheduled, disconnect the plugin from UpdraftCentral/remote control and block external POST requests to admin-ajax.php and the site root that carry the udrpc_message parameter at the WAF or reverse proxy (side effect: any legitimate remote backup orchestration will stop until the plugin is patched and reconnected). Rotate the UpdraftPlus remote-control key after patching, since the all-zero-key bypass means any previously intercepted traffic could be replayed.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today