漏洞描述
UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authentication bypass caused by insufficient validation in UpdraftPlus_Remote_Communications_V2::wp_loaded, letting unauthenticated attackers execute arbitrary RPC commands as admin, exploit requires no authentication.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
patchstack.comhttps://patchstack.com/database/vulnerability/wordpress-updraftplus-wp-backup-migration-plugin-1-26-4-unauthenticated-authentication-bypass-via-updraftcentral-udrpc-vulnerability↗teamupdraft.comhttps://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2026-10795↗