UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
CVE-2026-10795
Verified
Description
UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
Severity
High
CVSS Score
8.1
Exploit Probability
4%
Published Date
June 15, 2026
Template Author
theamanrawat, s4e-io
CVE-2026-10795.yaml
8.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-10795
CWE ID:
cwe-347
References
https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerabilityhttps://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/https://nvd.nist.gov/vuln/detail/CVE-2026-10795
Remediation Steps
Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.