CVE-2026-10795

CVE Enrichment

CVSS: 8.1 HIGH
EPSS: 3.64%
EPSS Percentile: 89.43%
CISA KEV: Not listed

Description

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: security@wordfence.com
Published: 11-Jun-2026 14:16
Last Modified: 23-Jul-2026 16:10
EPSS Date: 2026-10-20
CWE: CWE-347

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 21-Oct-2026 11:55
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

second incident in this channel in five months," Patchstack warned. "In June 2026 the vendor fixed CVE-2026-10795 (CVSS 8.1), where an obsolete unsigned message format let an attacker forge UpdraftCentral commands TeamUpdraft Breach Leads to Backdoor Attempts on Connected WordPress Sites
“All three sites ran the current WordPress 7.1.3 and UpdraftPlus 2.26.11, which is patched against the June vulnerability CVE-2026-10795,” Nethemba says. Stolen TeamUpdraft Keys Used to Backdoor WordPress Sites

People (3)

MITRE ATT&CK (4)

Vendors (1)

Products (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.