Updraft vulnerability

  • Resolved styzer

    (@styzer)


    4 days, 12 hours ago

    My database disappeared. My host points to Updraft “potentially.”

    Affected Products

    • UpdraftPlus: WP Backup & Migration Plugin for WordPress, all versions up to and including 1.26.4

    Vulnerability Analysis

    The vulnerability resides in the UpdraftPlus remote communications V2 layer, specifically the wp_loaded handler in UpdraftPlus_Remote_Communications_V2. The RPC layer is intended to authenticate inbound commands using a shared secret and cryptographic signature verification before executing administrative actions. The implementation fails to enforce the message format strictly and does not check decryption return values. When decryption fails or returns an unexpected value, the code path proceeds with a derived key that collapses to all zero bytes. An attacker who can predict this key can encrypt and sign forged RPC payloads that the plugin treats as authentic administrator-issued commands. The plugin then dispatches the forged commands as the connected administrator, which exposes high-privilege operations such as plugin upload and activation.

    Source: https://www.sentinelone.com/vulnerability-database/cve-2026-10795/#cq=i1

    The page I need help with: [log in to see the link]

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Contributor bcrodua

    (@bcrodua)

    3 days, 23 hours ago

    Hi,

    I’m sorry to hear about the database loss.

    The vulnerability you referenced, CVE-2026-10795, was fixed in UpdraftPlus 1.26.5 free / 2.26.5 Premium in June. Please update to the latest release. Details are in our June security announcement.

    The separate October incident involved compromised UpdraftCentral Cloud connection keys. If your site has ever been connected to that service, please complete all checks in our October incident announcement.

    We cannot establish whether either incident caused your database loss from the information provided.

    Kind regards,
    Bryle

    motiberman

    (@motiberman)

    2 days, 13 hours ago

    Ask the host for a pre-incident database restore and for access/error logs around the moment the database vanished — without that timeline it is hard to tie the loss to a specific CVE. Update UpdraftPlus to a current release; Bryle already noted CVE-2026-10795 was fixed in 1.26.5 free / 2.26.5 Premium, and the October Central-key incident is a separate track with its own checklist: https://teamupdraft.com/blog/security-incident-october-2026/ Rotate WordPress, host, SFTP, and database credentials, and preserve evidence before overwriting anything. Press the host to say which incident timeline they mean.

    Plugin Author David Anderson / Team Updraft

    (@davidanderson)

    1 day, 17 hours ago

    Was your site connected to UpdraftCentral, or was it created by migrating another site using UpdraftPlus Premium’s direct site-to-site migration feature (i.e. not just migrated with UpdraftPlus, but specifically using that direct feature in Premium)? One of those two things has to have been present to be vulnerable for the above two issues.

    Thread Starter styzer

    (@styzer)

    1 day, 16 hours ago

    My host was able to create a new database, connect it to the site somehow and restore most of the content. I did restore the rest manually.

    David, none of these, only Updraftplus, So it could be that it’s not connected to an Updraft vulnerability at all.

    Thanks for chiming in,

    Andre

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.