CVE-2026-10795highexploração observadaCWE-347

CVE-2026-10795: falha de alta gravidade em davidanderson UpdraftPlus: WP Backup &…

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

Publicada em

Seguir esta CVE+ Monitorar UpdraftPlus: WP Backup & Migration Plugin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

63Vexday Risk Score

Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.

ssvc Actcvss 8.1epss 4.3%
da publicação à armano mesmo dia
Publicada no NVD11 de jun.
1ª PoC11 de jun.
VulnCheck10 de jun.
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
davidanderson · UpdraftPlus: WP Backup & Migration Plugin
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — davidanderson UpdraftPlus: WP Backup &…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-10957HIGHUpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object InjectionEPSS 0.7%CVE-2025-0215MEDIUMUpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2023-5982MEDIUMUpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage UpdateEPSS 0.3%