CVE-2026-76549

MediumCVSS 5.9

Published: 27/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.10%

1th percentile - higher than 1% of all known CVEs

Summary

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions. Attackers could make a logged-in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

Risk Assessment

An attacker can revert the site to a pre-update state or with known vulnerabilities, potentially leading to data loss or re-exploitation of known flaws.

Recommendation

Update the UpdraftPlus plugin to version 1.26.7 or later, which includes security fixes.

Other vulnerabilities in UpdraftPlus

CVE-2026-10795High
The UpdraftPlus: WP Backup & Migration plugin for WordPress up to version 1.26.4 has an authentication bypass vulnerability in the UpdraftPlus_Remote_Communications_V2::wp_loaded function. Insufficient validation of remote communication messages allows signature verification bypass and predictable encryption keys, enabling unauthenticated attackers to execute arbitrary RPC commands as admin.

Original NVD description (English source)

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.