# UpdraftPlus <= 1.26.12 - Unauthenticated Continued Access via Unrevoked Compromised UpdraftCentral Keys

- **ID:** WPSEC-2026-1273
- **Plugin:** UpdraftPlus: WP Backup & Migration Plugin (`updraftplus`), https://wordpress.org/plugins/updraftplus/
- **Affected versions:** all versions before 1.26.13
- **Fixed in:** 1.26.13 (Update to 1.26.13 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-324
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/updraftplus
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1273/

## Description

The UpdraftPlus plugin for WordPress is vulnerable to continued unauthorized access via UpdraftCentral keys linked to UpdraftPlus.com in all versions up to, and including, 1.26.12. This is because these keys were never revoked after the October 2026 UpdraftPlus.com security incident. Releases before 1.26.12 contain no revocation at all. In 1.26.12 the revocation routine is hooked to plugins_loaded without an explicit cutoff, so WordPress passes it an empty string in place of the cutoff timestamp. No key's creation time then compares as earlier, and nothing is deleted. The routine also runs only on requests where the stored plugin version is older than the running version. This makes it possible for unauthenticated attackers who hold one of these keys to keep remote UpdraftCentral control of the site, including running backups, restores and other site-management actions.

## References

- https://wpsec.com/vuln/WPSEC-2026-1273/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.13/
- https://wordpress.org/plugins/updraftplus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1273/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.