213 matches found
CVE-2026-10795-Lab
CVE Lab: CVE-2026-10795 - 通过 UpdraftCentral RPC 身份认证绕过连锁利用实现插件安装 执行摘要 此仓库包含一个本地 Docker 实验室，用于重现和验证 CVE-2026-10795，这是一个未认证的身份认证绕过漏洞，影响通过其 UpdraftCentral 远程通信层的 UpdraftPlus WordPress 插件。 易受攻击的行为存在于 UpdraftCentral RPC 消息处理流程中。在易受攻击的版本中，伪造的 format=1 RPC 消息可以绕过签名验证，触发失败的 RSA 解密路径，并仍然以可预测的 null key/nul...
CVE-2026-10795
CVE-2026-10795 CVE-2026-10795 – UpdraftPlus 認証バイパス CVE-2026-10795 – UpdraftPlus 認証バイパス PoC ⚠️ 免責事項: このリポジトリは教育目的のみ です。 自分が所有するシステム、または明示的なテスト許可があるシステムでのみ使用してください。 著者は誤用に対する一切の責任を負いません。 📋 概要 フィールド| 詳細 ---|--- プラグイン| UpdraftPlus: WP Backup & Migration 影響を受けるバージョン| ≤ 1.26.4 修正バージョン| 1.26.5 CVSS スコア|...
UpdraftPlus < 1.22.9 - Cross-Site Scripting
The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0864 info: name: UpdraftPlus 1.22.9 - Cross-Site Scripting author: DhiyaneshDk severity: medium description...
CVE-2026-82841
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...
WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 2.23.8-2.26.8.25 - Subscriber+ Remote Storage Credential Disclosure vulnerability
Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 2.23.8-2.26.8.25...
CVE-2026-82841 UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...
EUVD-2026-87887
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...
WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 1.23.8-1.26.7 - Subscriber+ Remote Storage Credential Disclosure vulnerability
Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 1.23.8-1.26.7...
CVE-2026-82841 UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...
CVE-2026-82841
The UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions before 1.26.8 and before 2.26.8.26 ) contains a vulnerability where it fails to perform a capability check in a routine that outputs stored remote storage settings. When a site is left in a specific post-migration state , this ...
CVE-2026-76549
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...
CVE-2026-76549 UpdraftPlus < 1.26.7 - Backup Restoration via CSRF
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...
CVE-2026-76549 UpdraftPlus < 1.26.7 - Backup Restoration via CSRF
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...
EUVD-2026-66877
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...
WordPress UpdraftPlus: WP Backup & Migration Plugin plugin < 1.26.7 - Backup Restoration vulnerability
Backup Restoration vulnerability discovered by Jashid Sany in WordPress Plugin UpdraftPlus versions 1.26.7...
CVE-2026-76549
The UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions before 1.26.7 ) is vulnerable to a Cross-Site Request Forgery (CSRF) . The flaw exists because the plugin lacks proper CSRF checks in one of its backup management actions. An attacker could trick a logged-in administrator into ...
CVE-2026-76549: Cross-Site Request Forgery (CSRF)
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...
PT-2026-82418
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...
