UpdraftPlus <= 1.26.12 - Unauthenticated Continued Access via Unrevoked Compromised UpdraftCentral Keys
- ID
- WPSEC-2026-1273
- Plugin
- UpdraftPlus: WP Backup & Migration Plugin (updraftplus)
- Affected
- all versions before 1.26.13
- Remediation
- Update to 1.26.13 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-324
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- UpdraftPlus on WPSec AttackSurface
- Fix released
- Published
Description
The UpdraftPlus plugin for WordPress is vulnerable to continued unauthorized access via UpdraftCentral keys linked to UpdraftPlus.com in all versions up to, and including, 1.26.12. This is because these keys were never revoked after the October 2026 UpdraftPlus.com security incident. Releases before 1.26.12 contain no revocation at all. In 1.26.12 the revocation routine is hooked to plugins_loaded without an explicit cutoff, so WordPress passes it an empty string in place of the cutoff timestamp. No key's creation time then compares as earlier, and nothing is deleted. The routine also runs only on requests where the stored plugin version is older than the running version. This makes it possible for unauthenticated attackers who hold one of these keys to keep remote UpdraftCentral control of the site, including running backups, restores and other site-management actions.
References
- https://wpsec.com/vuln/WPSEC-2026-1273/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.13/
- https://wordpress.org/plugins/updraftplus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS