CVE-2026-66708

HighCVSS 8.2

Published: 06/08/2026(UTC)Updated: 12/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

13th percentile - higher than 13% of all known CVEs

Summary

Broken Access Control vulnerability in Total Upkeep plugin up to version 1.17.2, allowing an unauthenticated attacker to access administrative functions without authorization.

Risk Assessment

An attacker can perform administrative operations such as modifying settings or deleting data, potentially leading to full control of the website.

Recommendation

Update the Total Upkeep plugin to the latest version that includes a fix for this vulnerability.

Other vulnerabilities in Total Upkeep

CVE-2026-16253High
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.

Original NVD description (English source)

Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.