CVE-2026-10795: UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc

Synopsis

An authentication bypass vulnerability affects the UpdraftPlus: WP Backup and Migration Plugin for WordPress in all versions up to and including 1.26.4. The flaw lives in the UpdraftCentral remote communications handler, where insufficient validation of message signatures and unchecked decryption return values allow the encryption key to collapse to a predictable all-zero value. An unauthenticated remote attacker can forge arbitrary RPC commands that execute with administrator-level privileges, enabling remote code execution by uploading and activating a malicious plugin. No fix version has been published yet; HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the WordPress site over the network, as the vulnerable RPC endpoint is exposed via HTTP.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability allows a completely unauthenticated attacker to forge valid-looking RPC commands.

• Victim interactionNot required

  The attack is fully automated and requires no action from any user or administrator on the target site.

• Attack complexityDetail

  Exploitation requires the attacker to engineer a crafted message that exploits the predictable all-zero key collapse, introducing moderate environmental conditions, though the decryption behavior is deterministic once understood.

Blast Radius

• A successful attacker can upload and activate an arbitrary plugin, giving them full remote code execution on the WordPress host.
• The attacker gains read access to all site content, stored credentials, and any secrets held in the WordPress database or filesystem.
• The attacker can modify or delete site content, database rows, and configuration files, including creating rogue administrator accounts.
• The attacker can crash or destabilize the WordPress application and any services co-located on the same host.