UpdraftPlus EUVD-2026-87887

Exploitation requires two things simultaneously: (1) an authenticated account of any privilege level, including a subscriber, which is trivial to obtain on sites that permit open user registration; and (2) the site must be left in a specific post-migration state in which UpdraftPlus outputs its stored remote-storage settings into admin pages via a routine lacking a capability check. This post-migration state is the primary limiting factor (reflected in CVSS AC:H) - it is transient and not the default operating condition, so most sites are not exploitable at a given moment. No user interaction from a victim and no elevated privileges are needed once both conditions hold. Affected: UpdraftPlus 2.23.8 through <2.26.8.26 and 1.23.8 through <1.26.8; fixed in 1.26.8 and 2.26.8.26.

Signals converge on a genuine-but-moderate issue. The vendor CVSS 3.1 base of 5.3 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) captures the core: network-reachable but requiring low-privilege authentication and, critically, a high-complexity precondition (the site must be left in a 'particular post-migration state'). EPSS is very low at 0.14% (3rd percentile), there is no CISA KEV listing, and SSVC scores Exploitation:none / Automatable:no / Technical Impact:partial - all indicating this is not being mass-exploited and is not trivially wormable. However, a public exploit reference exists (WPScan), so exploitation is feasible for a motivated attacker who finds a vulnerable-state site. These signals are internally consistent: low EPSS + Automatable:no + AC:H all reflect the same conditional trigger, not a conflict. This is a real priority ONLY for sites that have recently performed a migration and were left in the affected state; for the general population it is a low-urgency patch. The impact, though, is meaningful: disclosure of backup-destination credentials (cloud storage passwords/secret keys) can enable lateral access to off-site data stores well beyond the WordPress instance itself.

On a site left in a specific post-migration state, an attacker holding only a low-privilege account (e.g., a self-registered subscriber) loads an admin-facing page where UpdraftPlus renders its stored remote-storage settings without a capability check, and reads back the configured backup destination credentials (passwords, secret keys). A public exploit/write-up exists via WPScan, but the required post-migration state (reflected in the CVSS AC:H) limits opportunistic reuse.