CVE-2017-16871

High

Published: 17/11/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution due to a race condition in the plupload_action function in /wp-content/plugins/updraftplus/admin.php before deleting a file associated with the name parameter.

Risk Assessment

An attacker could exploit this vulnerability to remotely execute code, potentially leading to full control over the website. However, the vendor reports that this does not cross a privilege boundary.

Recommendation

It is recommended to update the UpdraftPlus plugin to the latest version to mitigate this vulnerability. Additionally, server logs should be monitored for any potential exploitation attempts.

Other vulnerabilities in UpdraftPlus plugin for WordPress

CVE-2017-16870High
The UpdraftPlus plugin for WordPress through version 1.13.12 has an SSRF vulnerability in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction.

Original NVD description (English source)

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary

Vulnerability data from NVD (NIST) · CISA KEV · EPSS