{"id":19048592,"date":"2026-10-19T07:57:13","date_gmt":"2026-10-19T07:57:13","guid":{"rendered":"https:\/\/wordpress.org\/support\/?post_type=topic&#038;p=19048592"},"modified":"2026-10-19T09:40:44","modified_gmt":"2026-10-19T09:40:44","slug":"security-vulnerability-affecting-updraftplus-1-26-11","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/security-vulnerability-affecting-updraftplus-1-26-11\/","title":{"rendered":"Security vulnerability affecting UpdraftPlus 1.26.11"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I would like to report a potential security vulnerability affecting <strong>UpdraftPlus 1.26.11<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">On October 19, 2026, three separate WordPress installations on the same VPS were compromised. All three were running UpdraftPlus 1.26.11, with official plugin checksums successfully verified.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Our investigation revealed:<\/strong><\/p>\n\n\n\n<ul>\n<li>Three unauthorized plugins (flex-core-858, hero-hub-c9d, boost9pack-401f) containing administrator-access backdoors were installed.<\/li>\n\n\n\n<li>All three installations received POST requests from the same IPv6 address, immediately before the malicious plugin files appeared: 2a09:bac5:4e21:2e3c::49b:9..<\/li>\n\n\n\n<li>The HTTP User-Agent was <code>WordPress\/6.4; class-udrpc.php<\/code>.<\/li>\n\n\n\n<li>The internal UpdraftCentral logs recorded <code>Command received: plugin.upload_plugin<\/code> for all three installations.<\/li>\n\n\n\n<li>A fourth WordPress installation on the same VPS, without UpdraftPlus, showed no evidence of this attack.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The UpdraftCentral logs strongly suggest that the malicious plugins were uploaded through its RPC interface.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>We have not established whether this involved an authorization bypass, compromised credentials, or another vulnerability.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Given the similarities to previously reported UpdraftCentral vulnerabilities, I recommend investigating this as a potential security issue affecting version 1.26.11.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I can provide anonymized logs and malicious plugin samples through a secure reporting channel.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Kind regards<\/p>\n","protected":false},"template":"","class_list":["post-19048592","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19048592","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":2,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19048592\/revisions"}],"predecessor-version":[{"id":19048644,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19048592\/revisions\/19048644"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19048592"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}