CVE-2026-10795: UpdraftPlus Authentication Bypass Flaw

CVE-2026-10795 Overview

CVE-2026-10795 is an authentication bypass vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress. The flaw affects all versions up to and including 1.26.4 and resides in the UpdraftPlus_Remote_Communications_V2::wp_loaded function. Insufficient validation of the remote procedure call (RPC) message format allows signature verification to be bypassed. Unchecked decryption return values collapse to a predictable all-zero encryption key, enabling unauthenticated attackers to forge arbitrary RPC commands. Forged commands execute in the context of the connected administrator, permitting actions such as uploading and activating a malicious plugin to achieve remote code execution (RCE). The weakness is tracked under [CWE-347] (Improper Verification of Cryptographic Signature).

Critical Impact
Unauthenticated attackers can forge RPC commands, install malicious plugins, and obtain remote code execution on affected WordPress sites.

Affected Products

UpdraftPlus: WP Backup & Migration Plugin for WordPress, all versions up to and including 1.26.4
WordPress sites using the UpdraftPlus remote communications V2 RPC class (class-udrpc2.php)
Multisite WordPress installations running vulnerable UpdraftPlus versions

Discovery Timeline

2026-06-11 - CVE-2026-10795 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-10795

Vulnerability Analysis

The vulnerability resides in the UpdraftPlus remote communications V2 layer, specifically the wp_loaded handler in UpdraftPlus_Remote_Communications_V2. The RPC layer is intended to authenticate inbound commands using a shared secret and cryptographic signature verification before executing administrative actions. The implementation fails to enforce the message format strictly and does not check decryption return values. When decryption fails or returns an unexpected value, the code path proceeds with a derived key that collapses to all zero bytes. An attacker who can predict this key can encrypt and sign forged RPC payloads that the plugin treats as authentic administrator-issued commands. The plugin then dispatches the forged commands as the connected administrator, which exposes high-privilege operations such as plugin upload and activation.

Root Cause

The root cause is improper verification of cryptographic signatures combined with missing validation of decryption results. Signature checks can be bypassed because the message format is parsed leniently, and unchecked decryption return values lead to a deterministic all-zero symmetric key. This violates the trust assumption that only the paired remote party can produce valid RPC requests.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the WordPress site targeting the UpdraftPlus RPC endpoint. The request includes a forged RPC payload structured to bypass signature verification and use the predictable zero key. Once accepted, the attacker invokes administrator-level RPC commands, including uploading a malicious plugin archive and activating it. Plugin activation triggers PHP execution on the server, resulting in remote code execution. Attack complexity is elevated because the request must be crafted to align with the vulnerable parsing logic, but exploitation does not require credentials.

No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Analysis and the WordPress Changeset for UpdraftPlus for the corrective code path.

Detection Methods for CVE-2026-10795

Indicators of Compromise

Unexpected POST requests to WordPress endpoints handling UpdraftPlus RPC traffic, particularly to admin-ajax.php or wp-cron.php with UpdraftPlus action parameters.
New or unknown plugins appearing in wp-content/plugins/ with recent modification timestamps not initiated by site administrators.
PHP files written outside expected plugin directories, or web shells in wp-content/uploads/.
Outbound network connections from the WordPress host to attacker-controlled infrastructure following suspicious RPC requests.

Detection Strategies

Monitor WordPress access logs for requests containing UpdraftPlus RPC parameters from unauthenticated sources.
Alert on plugin install and activation events that do not correlate with an authenticated administrator session.
Inspect web application firewall (WAF) telemetry for anomalous payload structures targeting UpdraftPlus endpoints.

Monitoring Recommendations

Enable file integrity monitoring (FIM) on the wp-content/plugins/ directory to detect unauthorized plugin additions.
Forward WordPress audit logs and PHP error logs to a centralized logging platform for correlation.
Track process creation on the web server host for PHP processes spawning shells or invoking curl, wget, or php -r.

How to Mitigate CVE-2026-10795

Immediate Actions Required

Update UpdraftPlus to a version newer than 1.26.4 that includes the fix from WordPress Changeset 3561938.
If immediate patching is not possible, deactivate and remove the UpdraftPlus plugin until an update can be applied.
Audit wp-content/plugins/ for unknown plugins and remove any that were not installed by an administrator.
Rotate WordPress administrator credentials and any API keys stored within the site after confirming integrity.

Patch Information

The vendor released a fix in the UpdraftPlus repository. The corrective code is published in the WordPress plugin source control at class-udrpc2.php and the corresponding WordPress Changeset for UpdraftPlus. Apply the latest version available through the WordPress plugin updater.

Workarounds

Block external access to UpdraftPlus RPC endpoints at the WAF or reverse proxy layer until the patch is applied.
Restrict plugin install and activation capabilities by setting define('DISALLOW_FILE_MODS', true); in wp-config.php to prevent unauthorized plugin uploads.
Limit access to wp-admin and admin-ajax.php by source IP where operationally feasible.

bash

# Configuration example: disable plugin/theme file modifications in wp-config.php
echo "define('DISALLOW_FILE_MODS', true);" >> /var/www/html/wp-config.php

# Update UpdraftPlus via WP-CLI once a fixed release is available
wp plugin update updraftplus --path=/var/www/html