CVE-2026-10795

HighCVSS 8.1

Published: 11/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.58%

88th percentile - higher than 88% of all known CVEs

Summary

The UpdraftPlus: WP Backup & Migration plugin for WordPress up to version 1.26.4 has an authentication bypass vulnerability in the UpdraftPlus_Remote_Communications_V2::wp_loaded function. Insufficient validation of remote communication messages allows signature verification bypass and predictable encryption keys, enabling unauthenticated attackers to execute arbitrary RPC commands as admin.

Risk Assessment

An attacker can remotely take over a WordPress site, including uploading and activating a malicious plugin, leading to remote code execution.

Recommendation

Update the UpdraftPlus plugin to a version later than 1.26.4 that includes the fix.

Other vulnerabilities in UpdraftPlus

CVE-2026-76549Medium
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions. Attackers could make a logged-in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

Original NVD description (English source)

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.