Now officially on WordPress.org

CVE Database / CVE-2022-0633

CVE · Medium

CVE-2022-0633 — UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.22.3

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2022-0633 UpdraftPlus: WP Backup & Migration Plugin [updraftplus] < 1.22.3 Incorrect Authorization Medium 6.5 < 1.22.3 1.22.3 2022-02-17 —

CVE-2022-0633

The UpdraftPlus backup plugin for WordPress contains an authorization bypass flaw in versions prior to 1.22.3 (free) and 2.22.3 (premium) that fails to verify user permissions when accessing backup nonce identifiers. An authenticated attacker with minimal privileges, such as a subscriber account, can exploit this vulnerability to download the most recent site and database backups, potentially exposing sensitive system information. The vulnerability exists in the heartbeat function and allows attackers to discover paths to backup files without proper capability checks.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings