Each version is cleaned, compared against the vendor’s license code and scanned before it is committed. A version that does not pass is not published. Last scan .
Published versions42
Files scanned65K
Findings reviewed2,587
Versions held back4
Held back: archives of this plugin that did not pass the automatic checks and are not published. Findings reviewed: matches of the rules that were checked and resolved before publication.
Reporting a vulnerability. Security problems in the plugin’s own code belong to the vendor, TeamUpdraft, DavidAnderson; report them there. Problems with a package as this repository distributes it — a file that should not be there, a scan that missed something — go to packages@meteorgpl.com, and are answered within 48 hours.
What happens on a finding. The affected versions are withdrawn from the repository, watchers of the package are notified, and a corrected version is published when one passes every check.
Rights holders. The takedown policy describes how a package is removed.
Known vulnerabilities
Public vulnerability reports for UpdraftPlus - Backup/Restore, the versions they affect and the version in this repository that fixes them. Watchers and accounts known to run an affected version are alerted.
1 version in this repository is affected: 2.26.4.26
Details
The UpdraftPlus plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 1.23.8 through 1.26.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract sensitive user or configuration data.
Remediation: Update to one of the following versions, or a newer patched version: 1.26.8, 2.26.8.26
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to 1.26.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Remediation: Update to version 1.26.7, or a newer patched version
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 (free) and versions up to 2.26.5 (premium) via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.
Remediation: Update to version 1.26.5, or a newer patched version
CWE-347: Improper Verification of Cryptographic Signature
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.
Remediation: Update to version 1.25.1, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.
Remediation: Update to version 1.24.12, or a newer patched version
The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.
Remediation: Update to version 1.23.11, or a newer patched version
The UpdraftPlus plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.23.3. This is due to missing or incorrect nonce validation on the action_authenticate_storage function. This makes it possible for unauthenticated attackers to inject JavaScript into a parameter in the authentication process via a forged request which will execute in their browser at another part of the process, granted they can trick a site administrator into performing multiple actions including re-authenticating a connection to storage.
Remediation: Update to version 1.23.4, or a newer patched version
11 versions in this repository are affected: 2.23.1.26, 2.22.25.26, 2.22.24.26, 2.22.23.25, 2.22.22.25, 2.22.21.25, 2.22.20.25, 2.22.19.25, 2.22.17.25, 2.22.16.25, 2.22.14.25
Details
The UpdraftPlus plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the 'updraft_central_ajax_handler' function in versions from 1.22.14 to 1.23.2 inclusive, and 2.22.14 to 2.23.2 of the premium version. This allows authenticated attackers, with subscriber-level permissions or above, to update the plugin's settings in such a way that can allow them to perform administrator-level actions on some sites.
Remediation: Update to one of the following versions, or a newer patched version: 1.23.3, 2.23.3
The Updraft Plus plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 1.22.24. This is due to the fact that the 'updraft_ajaxrestore' function generates a log file containing system configuration information. This makes it possible for unauthenticated attackers to trigger generation of such a log file, though it is only possible to access it on configurations that do not respect the "deny from all" directive.
Remediation: Update to version 1.23.1, or a newer patched version
CWE-532: Insertion of Sensitive Information into Log File
The "UpdraftPlus WordPress Backup Plugin" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'updraft_interval' parameter in versions up to 1.22.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Remediation: Update to version 1.22.9, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
The UpdraftPlus WordPress Backup Plugin plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when performing a heartbeat function in versions up to 1.22.3. This makes it possible for authenticated attackers with minimal permissions such as a subscriber to retrieve the path to arbitrary back-up files which can subsequently be downloaded and used to gain sensitive information about the system. This also affects premium versions before before 2.22.3.
Remediation: Update to version 1.22.3, or a newer patched version
The UpdraftPlus WordPress Backup Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'updraft_restore' parameter in versions up to, and including, 1.16.68 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Remediation: Update to version 1.16.69, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus WordPress Backup Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'backup_timestamp' & 'job_id' parameters in versions up to, and including, 1.16.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Remediation: Update to version 1.16.66, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.16.56 via the updraft_service settings. This makes it possible for authenticated attackers, with administrator-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Remediation: Update to version 1.16.59, or a newer patched version
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.6.59 does not sanitise its updraft_service settings, allowing high privilege users to set malicious JavaScript payload in it and leading to a Stored Cross-Site Scripting issue
Remediation: Update to version 1.6.59, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus free plugin before 1.9.64 (and UpdraftPlus paid before 2.9.64) are vulnerable to Cross-Site Scripting via add_query_arg() and remove_query_arg().
Remediation: Update to version 1.9.64, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus WordPress plugin for WordPress is vulnerable to Cross-Site Scripting via the 'add_query_arg()' and 'remove_query_arg()' functions in versions up to, and including, 1.9.6.3 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.
Remediation: Update to version 1.9.6.4, or a newer patched version
CWE-79: Improper Neutralization of Input During Web Page Generation
The UpdraftPlus WordPress Backup Plugin for WordPress is vulnerable to nonce leak which leads to authorization bypass in versions up to, and including, 1.9.50. This is due to incorrect use of several 'admin_action_' hooks. This makes it possible for authenticated attackers to arbitrarily upload files, download backups and retrieve secret keys.
Remediation: Update to version 1.9.51, or a newer patched version
Copyright 2012-2026 Defiant Inc.. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. https://www.cve.org/Legal/TermsOfUse
