{"id":19064409,"date":"2026-11-04T21:22:25","date_gmt":"2026-11-04T21:22:25","guid":{"rendered":"https:\/\/wordpress.org\/support\/?post_type=topic&#038;p=19064409"},"modified":"2026-11-04T22:13:16","modified_gmt":"2026-11-04T22:13:16","slug":"updraft-vulnerability","status":"publish","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/updraft-vulnerability\/","title":{"rendered":"Updraft vulnerability"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">My database disappeared. My host points to Updraft &#8220;potentially.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Affected Products<\/p>\n\n\n\n<ul>\n<li>UpdraftPlus: WP Backup &amp; Migration Plugin for WordPress, all versions up to and including 1.26.4<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Vulnerability Analysis<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerability resides in the UpdraftPlus remote communications V2 layer, specifically the wp_loaded handler in UpdraftPlus_Remote_Communications_V2. The RPC layer is intended to authenticate inbound commands using a shared secret and cryptographic signature verification before executing administrative actions. The implementation fails to enforce the message format strictly and does not check decryption return values. When decryption fails or returns an unexpected value, the code path proceeds with a derived key that collapses to all zero bytes. An attacker who can predict this key can encrypt and sign forged RPC payloads that the plugin treats as authentic administrator-issued commands. The plugin then dispatches the forged commands as the connected administrator, which exposes high-privilege operations such as plugin upload and activation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Source: https:\/\/www.sentinelone.com\/vulnerability-database\/cve-2026-10795\/#cq=i1<\/p>\n","protected":false},"template":"","class_list":["post-19064409","topic","type-topic","status-publish","hentry"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19064409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":1,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19064409\/revisions"}],"predecessor-version":[{"id":19064441,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/19064409\/revisions\/19064441"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=19064409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}