home / blog
2026-11-04 · high
CVE-2026-10795: Authentication Bypass in UpdraftPlus Plugin
Authentication bypass in UpdraftPlus plugin (versions up to 1.26.4) allows RCE as administrator. CVSS 8.1.
CVE-2026-10795 is an authentication bypass vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress. The UpdraftPlus_Remote_Communications_V2::wp_loaded function does not properly validate the format of remote communications messages, bypassing signature verification and creating predictable encryption keys. An unauthenticated attacker can forge RPC commands as administrator and install malicious plugins for complete remote access.
CVSS 8.1, classified HIGH by NVD. Proof-of-concept code is available on public GitHub repositories as of November 4, 2026. The vulnerability was reported to NVD on June 11, 2026. These signals indicate concrete risk of active exploitation for sites running vulnerable versions up to 1.26.4.
Administrators: verify installed version and update immediately. Review currently installed plugins for suspicious components and audit administrator access logs. IT teams: implement plugin update monitoring and consider automatic update policies for backup and migration plugins.
At a glance
- What
- Authentication bypass in UpdraftPlus plugin for WordPress. The UpdraftPlus_Remote_Communications_V2::wp_loaded function does not properly validate remote communications messages, allowing signature verification to be bypassed and exploiting predictable encryption keys to forge arbitrary RPC commands.
- Severity
- CVSS 8.1 (HIGH). Allows unauthenticated users to execute RPC commands as administrator, including uploading and activating malicious plugins leading to remote code execution.
- Affected versions
- All versions up to and including 1.26.4.
- Fix
- Update UpdraftPlus plugin to a version later than 1.26.4; specific version not reported in available data.
- Status
- Vulnerability confirmed on NVD (June 11, 2026). Proof-of-concept available on public GitHub repositories since November 4, 2026, labeled as educational material.
- Action
- Administrators: verify installed version, update immediately, check for suspicious plugins, audit admin access logs. IT teams: implement plugin update monitoring and automatic update policies.
Sources: NVD, CVE-2026-10795