A critical unauthenticated authentication bypass vulnerability in the UpdraftPlus plugin has been patched, which could allow unauthenticated attackers to execute actions with administrator privileges on certain websites. The vulnerability affects sites previously connected to UpdraftCentral and could be used to upload malicious plugins and execute arbitrary code.
Root cause of the vulnerability
The vulnerability, tracked as CVE-2026-10795 and assigned a CVSS score of 8.1, affects UpdraftPlus versions 1.26.4 and earlier. Discovered by security researcher vtim, the flaw stems from insufficient validation within the plugin’s remote communications functionality.
The vulnerability lies in the remote communications system used by UpdraftPlus to interact with UpdraftCentral. Once a site is connected to the management dashboard, the plugin registers an unauthenticated RPC listener capable of receiving and processing remote udrpc_message requests on behalf of the connected administrator.
The researchers found that the plugin’s message decryption routine failed to validate the return value of an RSA decryption operation. When decryption failed, the resulting value could cause the message to be processed using a deterministic encryption configuration that attackers could reproduce without access to the site’s cryptographic keys. This allowed unauthenticated attackers to craft forged udrpc_message requests that would be accepted and dispatched as if they had been sent by the connected UpdraftCentral dashboard.
These forged requests were executed using the privileges of the administrator who originally connected the site to UpdraftCentral. By leveraging RPC actions such as plugin upload and activation, attackers could deploy a malicious plugin and achieve arbitrary PHP and operating system command execution on vulnerable sites.
The Patch
The issue was fully patched in version 1.26.5 of the plugin, and users are advised to update to it immediately.