Title: Updraft vulnerability
Last modified: November 4, 2026

---

# Updraft vulnerability

 *  Resolved [styzer](https://wordpress.org/support/users/styzer/)
 * (@styzer)
 * [4 days, 12 hours ago](https://wordpress.org/support/topic/updraft-vulnerability/)
 * My database disappeared. My host points to Updraft “potentially.”
 * Affected Products
    - UpdraftPlus: WP Backup & Migration Plugin for WordPress, all versions up to
      and including 1.26.4
 * Vulnerability Analysis
 * The vulnerability resides in the UpdraftPlus remote communications V2 layer, 
   specifically the wp_loaded handler in UpdraftPlus_Remote_Communications_V2. The
   RPC layer is intended to authenticate inbound commands using a shared secret 
   and cryptographic signature verification before executing administrative actions.
   The implementation fails to enforce the message format strictly and does not 
   check decryption return values. When decryption fails or returns an unexpected
   value, the code path proceeds with a derived key that collapses to all zero bytes.
   An attacker who can predict this key can encrypt and sign forged RPC payloads
   that the plugin treats as authentic administrator-issued commands. The plugin
   then dispatches the forged commands as the connected administrator, which exposes
   high-privilege operations such as plugin upload and activation.
 * Source: [https://www.sentinelone.com/vulnerability-database/cve-2026-10795/#cq=i1](https://www.sentinelone.com/vulnerability-database/cve-2026-10795/#cq=i1)
 * The page I need help with: _[[log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fupdraft-vulnerability%2F%3Foutput_format%3Dmd&locale=en_US)
   to see the link]_

Viewing 4 replies - 1 through 4 (of 4 total)

 *  Plugin Contributor [bcrodua](https://wordpress.org/support/users/bcrodua/)
 * (@bcrodua)
 * [3 days, 23 hours ago](https://wordpress.org/support/topic/updraft-vulnerability/#post-19064827)
 * Hi,
 * I’m sorry to hear about the database loss.
 * The vulnerability you referenced, CVE-2026-10795, was fixed in UpdraftPlus 1.26.5
   free / 2.26.5 Premium in June. Please update to the latest release. Details are
   in our [June security announcement](https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/).
 * The separate October incident involved compromised UpdraftCentral Cloud connection
   keys. If your site has ever been connected to that service, please complete all
   checks in our [October incident announcement](https://teamupdraft.com/blog/security-incident-october-2026/).
 * We cannot establish whether either incident caused your database loss from the
   information provided.
 * Kind regards,
   Bryle
 *  [motiberman](https://wordpress.org/support/users/motiberman/)
 * (@motiberman)
 * [2 days, 13 hours ago](https://wordpress.org/support/topic/updraft-vulnerability/#post-19066264)
 * Ask the host for a pre-incident database restore and for access/error logs around
   the moment the database vanished — without that timeline it is hard to tie the
   loss to a specific CVE. Update UpdraftPlus to a current release; Bryle already
   noted CVE-2026-10795 was fixed in 1.26.5 free / 2.26.5 Premium, and the October
   Central-key incident is a separate track with its own checklist: [https://teamupdraft.com/blog/security-incident-october-2026/](https://teamupdraft.com/blog/security-incident-october-2026/)
   Rotate WordPress, host, SFTP, and database credentials, and preserve evidence
   before overwriting anything. Press the host to say which incident timeline they
   mean.
 *  Plugin Author [David Anderson / Team Updraft](https://wordpress.org/support/users/davidanderson/)
 * (@davidanderson)
 * [1 day, 17 hours ago](https://wordpress.org/support/topic/updraft-vulnerability/#post-19066804)
 * Was your site connected to UpdraftCentral, or was it created by migrating another
   site using UpdraftPlus Premium’s direct site-to-site migration feature (i.e. 
   not just migrated with UpdraftPlus, but specifically using that direct feature
   in Premium)? One of those two things has to have been present to be vulnerable
   for the above two issues.
 *  Thread Starter [styzer](https://wordpress.org/support/users/styzer/)
 * (@styzer)
 * [1 day, 16 hours ago](https://wordpress.org/support/topic/updraft-vulnerability/#post-19066810)
 * My host was able to create a new database, connect it to the site somehow and
   restore most of the content. I did restore the rest manually.
 * David, none of these, only Updraftplus, So it could be that it’s not connected
   to an Updraft vulnerability at all.
 * Thanks for chiming in,
 * Andre

Viewing 4 replies - 1 through 4 (of 4 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fupdraft-vulnerability%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/updraftplus/assets/icon-256x256.png?rev=3729681)
 * [UpdraftPlus: WP Backup & Migration Plugin](https://wordpress.org/plugins/updraftplus/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/updraftplus/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/updraftplus/)
 * [Active Topics](https://wordpress.org/support/plugin/updraftplus/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/updraftplus/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/updraftplus/reviews/)

 * 4 replies
 * 4 participants
 * Last reply from: [styzer](https://wordpress.org/support/users/styzer/)
 * Last activity: [1 day, 16 hours ago](https://wordpress.org/support/topic/updraft-vulnerability/#post-19066810)
 * Status: resolved