Update (2026/10/28): The original article had no CVE ID and described the affected conditions inaccurately. It has been rewritten against the official information for CVE-2026-10795 (NVD, and the vendor TeamUpdraft's notice and changelog). A web server configuration example that no official source recommends has been removed.
The WordPress backup and migration plugin UpdraftPlus: WP Backup & Migration Plugin has an authentication bypass (CVE-2026-10795) that lets an unauthenticated attacker run operations as an administrator. The free version was fixed in 1.26.5. If you run 1.26.4 or earlier, update right away.
What to Do Now
- ✓Check the UpdraftPlus version under Plugins in the WordPress admin and update the free version to 1.26.5 or later (2.26.5 or later for Premium)
- ✓If you use the UpdraftCentral plugin, update it to 0.8.32 or later
- ✓If you cannot update (for example, because a Premium licence has expired), install the vendor's official hotfix (updraftplus-hotfix-jun2026). The download and steps are in the TeamUpdraft notice listed under the reference sources. You can remove it after updating to a fixed version
- ✓Look for administrator users or plugins you do not recognize
- ✓If you find a suspicious plugin or administrator, consult your site maintainer or hosting provider, and change passwords and server credentials
This score is the assessment from the CVE numbering authority (Wordfence) as listed on NVD. As of October 28, 2026, NIST has not added its own assessment. Scores can differ by CVSS version and by assessor, so check the NVD page for the latest value.
What the Vulnerability Does
According to NVD, the remote communications handler in UpdraftPlus (UpdraftPlus_Remote_Communications_V2::wp_loaded) does not sufficiently validate the message format. Signature verification can be bypassed, and unchecked decryption failures collapse to a predictable all-zero encryption key. An unauthenticated attacker can therefore forge RPC commands and run them as the connected administrator, for example by uploading and activating a malicious plugin, which ultimately leads to remote code execution (RCE).
Affected Sites and the Fixed Versions
- ▸Affected versions: UpdraftPlus free version 1.26.4 and earlier (per NVD). The vendor says UpdraftPlus and UpdraftCentral versions from roughly the last 10 to 11 years are affected
- ▸Fixed versions: UpdraftPlus free 1.26.5, Premium 2.26.5 or later, and the UpdraftCentral plugin 0.8.32 or later (vendor notice)
- ▸Per the plugin's changelog, the issue affects sites with an active Migrator key (paid versions only) or UpdraftCentral key (free and paid versions)
The original article said only that sites with a Migrator key (a premium feature) were affected. A free-version site is also affected if it has an UpdraftCentral key. Even if you do not use UpdraftCentral, treat the update as mandatory.
The original article included an Nginx example that restricted /wp-admin/ by IP address. It is not a mitigation given by the vendor or in the CVE record, and there is no basis to say it blocks this vulnerability, so it has been removed. The official remedies are updating to a fixed version or installing the official hotfix.
About the Attack Activity
The attack count in the original article could not be confirmed from a primary source, so it has been removed. As of October 28, 2026, this CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Not being listed does not mean there are no attacks. Decide based on whether you have updated, not on attack numbers.
📦