A bit of caution for everyone whose WordPress site uses the UpdraftPlus backup plugin; it needs to be updated as soon as possible. A serious security vulnerability has been discovered in the UpdraftPlus: WP Backup and Migration Plugin. This could affect more than 3 million websites and allow attackers to take full administrative control without even needing to log in.
Wordfence, one of the leading WordPress security firms, reported this flaw. A patch is already available.The longer you wait to update, the more exposed your site is.
What UpdraftPlus Is and Why So Many Sites Use It
UpdraftPlus is one of the most popular WordPress backup tools in the entire world. It lets users back up their websites, recover from errors and migrate WordPress sites to other domains or servers. This tool can also back up websites using various cloud services, and that is the reason why it has already been deployed in over three million active websites.
Due to its popularity, any vulnerability found in this plugin is a high-value target for attackers. It is because such vulnerability can be exploited across numerous sites, while another one might have only thousands of installs and will not benefit the attacker much.
What the Vulnerability Actually Does
The vulnerability affects all versions of the UpdraftPlus plugin up to and including version 1.26.4. The described flaw is referred to as the Authentication Bypass Vulnerability, but it requires additional clarification as it is widely used. Authentication is one of the stages during the interaction between a plugin and a website when it checks whether the incoming commands come from a legitimate user who is authorized to perform these actions on the website.
As the name suggests, in an authentication bypass flaw, attackers do not need to provide a username, password, or other forms of authorization to perform certain functions. The system treats every command from the attacker as if it came from a fully authorized site administrator.
This particular flaw was found in the UpdraftPlus_Remote_Communications_V2::wp_loaded function. As explained by Wordfence, the vulnerability is associated with a poor validation of remote communications messages format, as the signature can be bypassed, and the failed encryption verification is replaced by a predictable zero encryption key. Put simply, there is a coding flaw that results in a failed security measure and further vulnerabilities.
However, not every site that uses UpdraftPlus will be affected by this vulnerability. According to UpdraftPlus’ own changelog, this flaw only applies to websites that use either their Migrator Key (paid feature) or UpdraftCentral Key (both free and paid).
How an Attack Actually Plays Out
Once an attacker bypasses authentication, they can execute commands remotely through the plugin – and the system will carry them out as if they came from a site administrator. Among the many types of damage that the attacker can cause using this exploit, some of them include stealing information, installing any type of malware, modification of the website files, creating a backdoor, defacing the website, and using the compromised server to launch a DDoS attack against other systems.
According to Wordfence data, there have been around 8,172 attacks reported in just 24 hours on the basis of this specific vulnerability. It is not known exactly how many websites were hacked using this vulnerability since the number of victims remains unknown but what we do know is that attackers are actively targeting this exploit right now.
The Patch Is Out and the Fix Is Simple
Version 1.26.5 has been made available by UpdraftPlus to remedy this issue. This is mentioned explicitly in the changelog by the plugin itself where the developers state that prior versions had a flaw that enabled users with an active Migrator license or an active UpdraftCentral license key to perform actions that were unauthorized.
The procedure for updating is rather simple. All you need to do is log into your WordPress admin panel, select Plugins from there, and then select UpdraftPlus to update it to version 1.26.5 or later. If you run multiple WordPress websites, this process has to be repeated for all websites you manage.
What WordPress Site Owners Should Do Right Now
Apart from the UpdraftPlus updates, there are some other checks that you might want to perform while you have access.
The first one is to check the list of the currently active plugins and remove any you don’t recognize or no longer use. In case there has been any breach, there may be a malicious plugin on your website waiting for execution. Therefore, it is better to delete such plugins rather than deactivate them.
The second thing is to check your admin users as the authentication bypass attack may lead to creating new admin users that you are not aware of. In case you notice any unknown users, you should delete them right away and change passwords for all existing admin users.
Lastly, if you use any security plugin, e.g., Wordfence or Sucuri, you need to scan the whole website. It is always wise to run a site scan regardless of how recently you updated UpdraftPlus.
The broader takeaway here is not just about updating the plugin, but a stark reminder of why keeping all plugins updated matters. One of the most common entry points for WordPress attackers is outdated plugins. Attackers actively exploit the gap between when a patch is released and when site owners actually apply it.
Frequently Asked Questions
Q 1: What is the UpdraftPlus vulnerability and how serious is it?
It is an authentication bypass vulnerability that allows unauthenticated attackers to execute commands as an administrator on affected WordPress sites. It is classified as serious because it requires no login credentials and can lead to full site takeover through remote code execution.
Q 2: Which versions of UpdraftPlus are affected?
All versions up to and including version 1.26.4 are affected. Users should update to version 1.26.5 or newer immediately.
Q 3: Does every site with UpdraftPlus installed need to worry?
Not equally. The vulnerability specifically affects sites that have an active Migrator key, a paid feature, or an active UpdraftCentral key, which is available in both free and paid versions. That said, all users should update regardless.
Q 4: What can an attacker actually do if they exploit this flaw?
An attacker can forge administrator-level commands, upload and activate a malicious plugin, and execute code directly on the hosting server. This can result in data theft, malware injection, site defacement, backdoor creation, or the site being used to attack other targets.
Q 5: Has this vulnerability been actively exploited?
Yes. Wordfence reported blocking 8,172 attacks targeting this vulnerability within a single 24-hour period, confirming that attackers are actively attempting to exploit it.
Q 6: How do I fix this on my WordPress site?
Go to your WordPress dashboard, navigate to Plugins, and update UpdraftPlus to version 1.26.5 or the latest available version. If you manage multiple WordPress sites, update all of them.
Q 7: What should I check beyond just updating the plugin?
Review your active plugins list for anything unfamiliar, check your administrator accounts for any you do not recognize, change passwords on existing admin accounts, and run a full security scan using a plugin like Wordfence.
Q 8: What is remote code execution and why does it matter here?
Remote code execution means an attacker can run malicious code on your server from anywhere over the internet. Combined with the authentication bypass in this vulnerability, it means an attacker who exploits this flaw can potentially take full control of the affected website.
Q 9: Who discovered and reported this vulnerability?
The vulnerability was reported by Wordfence, a leading WordPress security firm that also tracks active attack attempts against WordPress sites.
