CVE-2026-10795
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 (free) and versions up to 2.26.5 (premium) via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2024-10957
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
+ 19 vulnerabilidades conocidas más
| CVE |
Vulnerabilidad |
Tipo |
Gravedad |
Afectadas |
Corregido en |
Publicado |
Estado |
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.23.1 |
— |
Desconocido
|
< 1.23.1
|
1.23.1 |
2023-03-09 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.23.1 |
— |
Desconocido
|
< 1.23.1
|
1.23.1 |
2023-03-08 |
✓ corregido en la última versión
|
|
CVE-2022-0864
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.22.9 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.22.9
|
1.22.9 |
2022-03-10 |
✓ corregido en la última versión
|
|
CVE-2022-0633
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.22.3 |
Autorización incorrecta |
Media
6,5
|
< 1.22.3
|
1.22.3 |
2022-02-17 |
✓ corregido en la última versión
|
|
CVE-2021-25089
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.69 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.16.69
|
1.16.69 |
2021-12-28 |
✓ corregido en la última versión
|
|
CVE-2021-25022
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.66 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.16.66
|
1.16.66 |
2021-12-06 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.59 |
— |
Desconocido
|
< 1.16.59
|
1.16.59 |
2021-07-12 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.59 |
— |
Desconocido
|
< 1.16.59
|
1.16.59 |
2021-07-12 |
✓ corregido en la última versión
|
|
CVE-2021-24423
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.6.59 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
4,8
|
< 1.6.59
|
1.6.59 |
2021-05-09 |
✓ corregido en la última versión
|
|
CVE-2015-9360
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.64 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.9.64
|
1.9.64 |
2019-08-28 |
✓ corregido en la última versión
|
|
CVE-2017-16871
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] <= 1.13.12 |
Control incorrecto de la generación de código (inyección de código) |
Alta
8,1
|
< 1.13.12
|
1.13.12 |
2017-11-17 |
✓ corregido en la última versión
|
|
CVE-2017-16870
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] <= 1.13.12 |
Falsificación de petición del lado del servidor (SSRF) |
Alta
8,1
|
< 1.13.12
|
1.13.12 |
2017-11-17 |
✓ corregido en la última versión
|
|
CVE-2017-18593
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.13.5 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.13.5
|
1.13.5 |
2017-08-08 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.6.4 |
— |
Desconocido
|
< 1.9.6.4
|
1.9.6.4 |
2015-04-20 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.6.4 |
— |
Desconocido
|
< 1.9.6.4
|
1.9.6.4 |
2015-04-20 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.51 |
— |
Desconocido
|
< 1.9.51
|
1.9.51 |
2015-02-03 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.51 |
— |
Desconocido
|
< 1.9.51
|
1.9.51 |
2015-02-03 |
✓ corregido en la última versión
|
|
CVE-2025-0215
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.25.1 |
Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS) |
Media
6,1
|
< 1.25.1
|
1.25.1 |
0000-00-00 |
✓ corregido en la última versión
|
|
—
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.59 |
— |
Desconocido
|
< 1.16.59
|
1.16.59 |
— |
✓ corregido en la última versión
|
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.23.1
Update the WordPress UpdraftPlus Extension plugin to the latest available version (at least 1.23.1).
Unknown discovered and reported this Sensitive Data Exposure vulnerability in WordPress UpdraftPlus Plugin. This vulnerability has been fixed in version 1.23.1.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.23.1
The Updraft Plus plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 1.22.24. This is due to the fact that the 'updraft_ajaxrestore' function generates a log file containing system configuration information. This makes it possible for unauthenticated attackers to trigger generation of such a log file, though it is only possible to access it on configurations that do not respect the "deny from all" directive.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2022-0864
The "UpdraftPlus WordPress Backup Plugin" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'updraft_interval' parameter in versions up to 1.22.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2022-0633
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
The UpdraftPlus WordPress Backup Plugin plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when performing a heartbeat function in versions up to 1.22.3. This makes it possible for authenticated attackers with minimal permissions such as a subscriber to retrieve the path to arbitrary back-up files which can subsequently be downloaded and used to gain sensitive information about the system. This also affects premium versions before before 2.22.3.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-25089
The UpdraftPlus WordPress Backup Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'updraft_restore' parameter in versions up to, and including, 1.16.68 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-25022
The UpdraftPlus WordPress Backup Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'backup_timestamp' & 'job_id' parameters in versions up to, and including, 1.16.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.59
Local File Inclusion (LFI) vulnerability discovered by WPScanTeam in WordPress UpdraftPlus plugin (versions <= 1.16.58).
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.59
The UpdraftPlus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.16.56 via the updraft_service settings. This makes it possible for authenticated attackers, with administrator-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2021-24423
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2015-9360
The UpdraftPlus free plugin before 1.9.64 (and UpdraftPlus paid before 2.9.64) are vulnerable to Cross-Site Scripting via add_query_arg() and remove_query_arg().
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2017-16871
The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2017-16870
The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
CVE-2017-18593
The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
CVE.org
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.6.4
This plugin is prone to a cross site scripting vulnerability, because of the misuse of the add_query_arg() and remove_query_arg() functions.
Update the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.6.4
The UpdraftPlus WordPress plugin for WordPress is vulnerable to Cross-Site Scripting via the 'add_query_arg()' and 'remove_query_arg()' functions in versions up to, and including, 1.9.6.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.51
This plugin is prone to a privilege escalation vulnerability.
Upgrade the plugin.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Patchstack
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.9.51
The UpdraftPlus WordPress Backup Plugin for WordPress is vulnerable to nonce leak which leads to authorization bypass in versions up to, and including, 1.9.50. This is due to incorrect use of several 'admin_action_' hooks. This makes it possible for authenticated attackers to arbitrarily upload files, download backups and retrieve secret keys.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
CVE-2025-0215
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
Wordfence
UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.16.59
The plugin did not validate its updraft_service settings, and using the user supplied value to include the related file, leading to a Local File Inclusion issue
Descripción técnica mostrada en el idioma original de la fuente (inglés).
Fuente:
WPScan
Mantén Updraftplus actualizado — 1.26.5 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").
Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.