CVE-2026-82841

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 1.23.8-1.26.7 - Subscriber+ Remote Storage Credential Disclosure vulnerability

Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 1.23.8-1.26.7...

CVE-2026-82841 UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

CVE-2026-82841

The UpdraftPlus: WP Backup & Migration Plugin for WordPress (versions before 1.26.8 and before 2.26.8.26 ) contains a vulnerability where it fails to perform a capability check in a routine that outputs stored remote storage settings. When a site is left in a specific post-migration state , this ...

CVE-2026-82841 UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

EUVD-2026-87887

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

WordPress UpdraftPlus: WP Backup & Migration Plugin plugin 2.23.8-2.26.8.25 - Subscriber+ Remote Storage Credential Disclosure vulnerability

Subscriber+ Remote Storage Credential Disclosure vulnerability discovered by Jakub Herman in WordPress Plugin UpdraftPlus versions 2.23.8-2.26.8.25...

CVE-2026-82841: Exposure of Sensitive Information to an Unauthorized Actor

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a...

PT-2026-99491

Name of the Vulnerable Software and Affected Versions UpdraftPlus: WP Backup & Migration Plugin versions prior to 1.26.8 UpdraftPlus: WP Backup & Migration Plugin versions prior to 2.26.8.26 Description A missing capability check in a routine that outputs stored remote storage settings into admin...

CVE-2026-76549: Cross-Site Request Forgery (CSRF)

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a...

CVE-2026-14490: Improper Limitation of a Pathname to a Restricted Directory

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7. The vulnerability exists because the plugin stores its HMAC signing key and per-step restore token as dotfiles inside a...

CVE-2026-15012: Exposure of Sensitive Information to an Unauthorized Actor

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

CVE-2026-14503 pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

CVE-2026-14503: Exposure of Sensitive Information to an Unauthorized Actor

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

CVE-2026-57757

Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...

EUVD-2026-41313

Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...

CVE-2026-57757

Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...

WordPress pCloud WP Backup plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by R2D2 in WordPress Plugin pCloud WP Backup versions = 2.0.6...

CVE-2026-57757: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in pCloud WP Backup = 2.0.2 versions...

CVE-2026-10795: Improper Verification of Cryptographic Signature

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlusRemoteCommunicationsV2::wploaded function. This is due to insufficient validation of the remote communications message format,...