CVE-2026-10795highexplotación observadaCWE-347

CVE-2026-10795: fallo de gravedad alta en davidanderson UpdraftPlus: WP Backup &…

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

Publicada el

Seguir esta CVE+ Monitorear UpdraftPlus: WP Backup & Migration Plugin

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

63Vexday Risk Score

Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.

ssvc Actcvss 8.1epss 4.3%
de la publicación al armael mismo día
Publicada en NVD11 jun
1ª PoC11 jun
VulnCheck10 jun
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
davidanderson · UpdraftPlus: WP Backup & Migration Plugin
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — davidanderson UpdraftPlus: WP Backup &…

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-10957HIGHUpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object InjectionEPSS 0.7%CVE-2025-0215MEDIUMUpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-5982MEDIUMUpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage UpdateEPSS 0.3%