CVE-2026-10795
Authentication bypass lets attackers take over WordPress sites via backup plugin.
This is a vulnerability in the UpdraftPlus WordPress backup plugin that lets unauthenticated attackers forge commands to a connected administrator account. Sites using UpdraftCentral connection keys are at risk; attackers have stolen those keys and are actively using them to install backdoors on sites, including fully patched ones. The plugin developer has disclosed the breach, and roughly 400,000 websites may be affected.
davidanderson UpdraftPlus: WP Backup & Migration Plugin · Updated 28 Oct · From 1 of our story and the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeverityhighCVSS 8.1 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- If you use UpdraftPlus, immediately revoke and regenerate all UpdraftCentral connection keys on the UpdraftCentral dashboard.
- Check your WordPress site for unauthorized admin accounts or plugins, and remove any suspicious ones.
- Update the UpdraftPlus plugin to the latest version if a fix becomes available; the record does not state a fixed version yet.
- Monitor your site for unusual activity, especially file uploads or plugin installations, as advised by security researchers.
What happened
- 21 OctTeamUpdraft disclosed that an attacker stole UpdraftCentral connection keys from its website.
- 21 OctSecurity researchers reported attackers are using the stolen keys to backdoor WordPress sites, including fully patched ones.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-10795 | UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc | high 8.1 | No | 4.3% |
The records
CVE-2026-10795 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works