UpdraftPlus Vulnerability: A Crypto Bug That Forged RPCs

PHP's RSA decryption call returns false when it fails. It doesn't throw an exception, it just hands back a boolean. UpdraftPlus's remote communications code never checked for that boolean. It took whatever came back from decryption and fed it straight into an AES-128 key setup, and PHP's type coercion turned false into a string of null bytes: a complete, predictable, all-zero encryption key. That's the entire vulnerability behind CVE-2026-10795, and it's why this UpdraftPlus vulnerability is worth understanding in more depth than "yet another auth bypass."

UpdraftPlus is one of the most widely installed WordPress backup plugins, with more than three million active installs according to the WordPress.org plugin directory. Its UpdraftCentral feature lets an administrator manage backups on multiple sites from one dashboard, using signed, encrypted remote procedure calls (RPC) to talk to each connected site. CVE-2026-10795 lives in that RPC layer. Wordfence scores it two ways. Its Intelligence database lists 9.8 Critical, while the score it submitted to the National Vulnerability Database is 8.1 High, because that version rates the attack complexity as high.

What's Affected, and Who's Actually Exposed

Every UpdraftPlus free version up to and including 1.26.4 carries the bug, fixed in 1.26.5. The premium version is fixed in 2.26.5, and the separate UpdraftCentral dashboard plugin is fixed in 0.8.32. All three patches shipped the same day, June 5, 2026, according to UpdraftPlus's own changelog on WordPress.org.

Here's the detail that matters most for figuring out if you were ever at risk. UpdraftPlus's changelog describes the flaw as affecting "sites with an active Migrator key (paid versions only) or UpdraftCentral key (free and paid versions)." That's a narrower population than "every UpdraftPlus site." The vulnerable RPC listener runs on every page load regardless of configuration, but an attacker has nothing to forge a command against if your site never generated an UpdraftCentral remote-access key or a Migrator key in the first place. No connection ever established, no "connected administrator" identity for a forged command to inherit.

UpdraftPlus's own team estimated, in the announcement accompanying the fix, that this affects "only a small percentage of users," putting the figure at under 10%. That's a vendor's self-reported estimate, not an independently audited number, but it lines up with how UpdraftCentral is actually used: most UpdraftPlus installs run local backups only and never touch the remote dashboard feature.

If you've never set up UpdraftCentral or bought the Migrator add-on, this specific bug had nothing to forge itself into on your site. If you have, or aren't sure, keep reading.

How the Forged RPC Works: Crypto That Fails Open

UpdraftCentral's remote communications class, UpdraftPlus_Remote_Communications_V2, registers a listener on wp_loaded that watches for incoming RPC messages on every request. A legitimate message from the UpdraftCentral dashboard is encrypted and signed using key material exchanged when the site was first connected. The listener's job is to decrypt the message, verify it came from the paired dashboard, and only then execute the command it contains.

The code that decrypts the message calls an RSA decryption function to recover the session key, then hands that key to an AES-128 cipher to decrypt the actual payload. When RSA decryption fails, on a malformed or simply wrong input, the function returns false instead of throwing an error. Nothing in the calling code checked for that. The false value passed straight into the AES key setup, and because PHP coerces false to an empty string in that context, the cipher ended up initialized with a key of all zero bytes.

Zero isn't a secret. Anyone can compute it without ever touching the real key exchange. An attacker builds their own RPC payload, encrypts it with that same all-zero AES-128 key, and sends it to the target's UpdraftCentral endpoint. The listener decrypts it successfully, because a wrong key was never checked against a right one, and dispatches it as if it came from the legitimate dashboard. Per Wordfence's own description of the flaw, the forged command runs "as the connected administrator." UpdraftCentral's RPC command set includes uploading and activating a plugin, which means an attacker with a working forgery can drop arbitrary PHP on the server and run it.

This is a different failure mode than the classic auth bypass we've written about before, where a check is simply missing or a comparison uses the wrong operator. Our miniOrange SAML writeup covered a case where a tri-state return value got treated as a plain boolean, letting a malformed signature slip through as valid. This bug goes one step further: the broken check doesn't just wave a bad signature through, it hands the attacker the actual key material needed to forge new messages from scratch.

Disclosure Timeline and Where Exploitation Stands Today

Researcher vtim reported the bug through Wordfence's Bug Bounty program and was paid $5,200 for it. UpdraftPlus says it was notified roughly 40 hours before its June 5, 2026 patch announcement, putting initial vendor notice around June 3. Wordfence deployed a firewall rule for its Premium, Care, and Response customers that same day, ahead of the public patch, which is standard practice for bugs reported through its bounty program.

Wordfence and the NVD published the public advisory on June 10 and 11, 2026, five to six days after the patch shipped. Wordfence recorded 4,987 blocked exploitation attempts against the vulnerability in the 24 hours immediately following disclosure. Free-tier Wordfence users got the matching firewall rule on July 3, 2026, the usual 30-day delay behind paid tiers.

Three months on, CVE-2026-10795 doesn't appear in CISA's Known Exploited Vulnerabilities catalog. We found no evidence of an ongoing mass-exploitation campaign beyond that initial post-disclosure spike. That's a different situation from a bug under active attack right now.

What hasn't changed is the math. UpdraftPlus still shows 3 million-plus active installs, there's no public data on how many of those sites remain on a pre-1.26.5 build, and the technical details behind the forgery are now public. A quiet bug with a known fix is still a bug worth checking for, especially on a site that has ever touched UpdraftCentral or Migrator.

How to Check Your Version and Your UpdraftCentral Connection

Start with the version:

wp plugin get updraftplus --field=version

Compare the result against 1.26.5 for the free plugin or 2.26.5 for premium. Anything older is unpatched.

Next, find out whether this bug ever had anything to forge against on your site. In wp-admin, go to Settings, then UpdraftPlus Backup, then the Advanced Tools tab, and look at the UpdraftCentral (Remote Control) section. If a remote-access key is listed there, your site has been connected to an UpdraftCentral dashboard at some point. The same tab shows Migrator key status if you run the premium migration add-on.

If you don't recognize the dashboard that key connects to, or you're certain you never set one up, that's worth investigating on its own, separate from this CVE. An unfamiliar UpdraftCentral connection is not normal on a site nobody configured for remote management.

What to Do Right Now

Update first. There's no partial mitigation worth running instead of the patch:

wp plugin update updraftplus

If you're on the premium build or run the standalone UpdraftCentral dashboard plugin, update those the same way, through your license portal or the WordPress admin.

If your site had an active UpdraftCentral or Migrator key and ran an unpatched version at any point before June 5, 2026, don't stop at updating. Check your plugin list for anything you didn't install, and check your administrator accounts for anything created without your knowledge. Our general checklist for signs a WordPress site has been hacked walks through what else to look for, and if you find something, our WordPress malware removal guide covers what a real cleanup involves beyond deleting one suspicious file.

Backup plugins carry more trust than most: they run privileged code by design and, in UpdraftPlus's case, accept remote commands over the network. That combination is exactly why bugs in this category deserve more scrutiny than a typical plugin update, not less. Our broader look at how WordPress sites actually get hacked covers where plugin-level bugs like this one fit next to the other common paths in.

Run a scan on your site to check your UpdraftPlus version against our vulnerability database and look for any indicators that something already got in.

References

• NVD: CVE-2026-10795 Detail
• UpdraftPlus official changelog (WordPress.org)
• TeamUpdraft: Important security update for UpdraftPlus and UpdraftCentral users
• WPScan: UpdraftPlus < 1.26.5 - Unauthenticated Authentication Bypass via UpdraftCentral udrpc (CVE-2026-10795)
• Wordfence: Critical Unauthenticated Authentication Bypass Vulnerability Patched in UpdraftPlus WordPress Plugin
• SentinelOne Vulnerability Database: CVE-2026-10795
• SecurityOnline: Critical UpdraftPlus CVE-2026-10795 Exploit Targets Millions