VulnSocial

CVE-2026-10795Patch

HIGHCVSS 8.1 · HIGH

Exploitation observed; activity peaked at 6 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

Back to dashboard
7.8/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-347

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 3 classified signals
  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 15 mentions across 8 observed days

What's happening

  • Active exploitation reported across 3 signals
  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 5 signals
  • Patch or workaround mentioned in 6 signals
  • Technical details provided in 14 signals
  • Disclosure: 5 classified signals
  • Peaked 6d ago at 6 mentions (2026-06-11); latest day: 1
  • 15 total mentions across 8 days

Deep dive

Activity timeline15 mentions / 8d
02356Mentions · 2026-06-10: 2Mentions · 2026-06-11: 6Mentions · 2026-06-12: 2Mentions · 2026-06-16: 1Mentions · 2026-06-28: 1Mentions · 2026-07-01: 1Mentions · 2026-07-10: 1Mentions · 2026-09-08: 1PoC Mentioned / Linked · 2026-06-10: 1PoC Mentioned / Linked · 2026-06-11: 3PoC Mentioned / Linked · 2026-07-01: 1Exploit Tool / Code · 2026-06-11: 1Active Exploitation · 2026-06-10: 1Active Exploitation · 2026-06-11: 1Active Exploitation · 2026-06-28: 1Patch / Workaround · 2026-06-10: 1Patch / Workaround · 2026-06-11: 2Patch / Workaround · 2026-06-12: 1Patch / Workaround · 2026-06-28: 1Patch / Workaround · 2026-07-01: 1Technical Details · 2026-06-10: 2Technical Details · 2026-06-11: 6Technical Details · 2026-06-12: 2Technical Details · 2026-06-16: 1Technical Details · 2026-06-28: 1Technical Details · 2026-07-01: 1Technical Details · 2026-07-10: 106-1006-1106-1206-1606-2807-0107-1009-08
Signal classification4 categories
Patch
533.3%
Disclosure
533.3%
Active Exploitation
320.0%
PoC
213.3%
Referenced assets15 URLs
By indicator
Classification over time
DateTotalLabels
2026-06-102
Active Exploitation1Patch1
2026-06-116
Active Exploitation1Disclosure2Patch1PoC2
2026-06-122
Disclosure1Patch1
2026-06-161
Disclosure1
2026-06-281
Active Exploitation1
2026-07-011
Patch1
2026-07-101
Patch1
2026-09-081
Disclosure1
Full discourse15 posts
  • yousukezan@yousukezan
    Active Exploitation

    WordPress向けバックアッププラグイン「UpdraftPlus」の脆弱性CVE-2026-10795が実際に悪用されており、数百万のサイトに影響する可能性があることが報告された。Wordfenceによると、過去24時間でこの脆弱性を狙った4,987件の攻撃を検知したという。 この脆弱性は、UpdraftPlusのリモート管理機能「UpdraftCentral」に存在する認証回避の問題である。暗号化されたリモートプロシージャコール（RPC）の処理に不備があり、認証されていない攻撃者が接続済み管理者として任意のRPCを実行できる。 原因は暗号処理の検証不備にある。記事によると、リモート通信ライブラリは認証不要のリスナーを登録している一方で、復号処理の重要な検証を適切に行っていなかった。細工したキーが与えられた場合、AES-128のゼロキーを用いる予測可能な状態へ移行し、攻撃者が独自に作成したコマンドを正規の通信として受け付けてしまうという。 悪用に成功した攻撃者はRPC機能を利用してZIP形式のプラグインをアップロードし、自動的に有効化できる。これにより任意のPHPコードやOSコマンドの実行が可能になると説明されている。 この脆弱性は研究者のvtim氏によって発見され、5,200ドルの報奨金が支払われた。開発チームは既に修正版を公開しており、問題の関数に厳格な戻り値チェックを追加して対処したとしている。 https://securityonline.info/updraftplus-cve-2026-10795-exploit/

    Post summary

    CVE‑2026‑10795 is actively exploited against WordPress sites via UpdraftPlus, with attackers bypassing authentication to execute arbitrary code; patches have been released.

    0311221.7K
    14.6K followersView on X
  • Daily CyberSecurity@the_yellow_fall
    Active Exploitation

    A critical UpdraftPlus CVE-2026-10795 vulnerability threatens 3 million sites. Hackers are exploiting this UpdraftPlus authentication bypass in the wild. https://securityonline.info/updraftplus-cve-2026-10795-exploit/ https://t.co/yHyLGWTQAX

    Post summary

    CVE-2026-10795 is a critical authentication bypass in UpdraftPlus, with reports that hackers are actively exploiting it against 3 million sites.

    00060524
    12.6K followersView on X
  • サイトドック｜Webセキュリティ解説 一ノ瀬あかり@sitedock_jp
    Active Exploitation

    300万サイトが使うWordPressバックアップの定番UpdraftPlusに、未認証の認証バイパス(CVE-2026-10795)。悪用でサイト乗っ取りに繋がり、すでに攻撃も観測。1.26.5/2.26.5で修正済みです。今すぐ版数確認を。

    Post summary

    CVE‑2026‑10795 is an unauthenticated authentication bypass in UpdraftPlus that is already being exploited in the wild; the issue has been patched in versions 1.26.5 and 2.26.5.

    1002073
    10 followersView on X
  • DFIR Radar@DFIR_Radar
    Patch

    CVE-2026-10795 (CVSS 8.1) in UpdraftPlus WordPress plugin allows unauthenticated RCE on sites connected to UpdraftCentral. Failed RSA decryption collapses to predictable all-zero AES key, enabling forged RPC commands. Update to v1.26. #DFIR_Radar https://t.co/Iy2UUaKJ5l

    Post summary

    CVE-2026-10795 permits unauthenticated RCE in UpdraftPlus due to an RSA decryption flaw, and users are urged to upgrade to v1.26 to mitigate the vulnerability.

    10010140
    1.6K followersView on X
  • Mr. OS@ksg93rd
    Disclosure

    #Threat_Research #Malware_analysis 1⃣ Robobox: Self driven malware creation and execution https://netaskari.substack.com/p/robobox-self-driven-malware-creation 2⃣ UpdraftPlus: PHP backdoor delivery attempts via CVE-2026-10795 https://offseq.com/en/research/the-backdoor-inside-the-backup-request 3⃣ Tengu: Reverse Engineering a Mirai-Style Linux/IoT Botnet https://app.reverser.space/p/duckie/tengu-reverse-engineering-a-mirai-style-linux-iot 4⃣ PEEP: A Chrome Extension RAT https://socradar.io/blog/peep-browser-rat-chrome-extension http://www.cyberpocket.org

    Post summary

    The post highlights several research pieces, including a new CVE-2026-10795 used for PHP backdoor delivery, but offers no exploit details, patches, or evidence of active exploitation.

    00010179
    3.4K followersView on X
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-10795 - high 🚨 UpdraftPlus WP Backup & Migration Plugin - Authentication Bypass > UpdraftPlus WP Backup & Migration Plugin for WordPress <= 1.26.4 contains an authenti... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-10795 @pdnuclei #NucleiTemplates #cve

    Post summary

    The post announces the high‑severity CVE‑2026‑10795, an authentication bypass in UpdraftPlus WP Backup & Migration Plugin (<=1.26.4), and links to Project Discovery for further details.

    00001142
    960 followersView on X
  • ToolsLib@ToolsLib
    Disclosure

    CVE-2026-10795: Authentication bypass in UpdraftPlus impacts sites connected to UpdraftCentral https://blog.toolslib.net/2026/06/12/cve-2026-10795-updraftplus-authentication-bypass/

    Post summary

    An authentication bypass vulnerability (CVE-2026-10795) in UpdraftPlus has been disclosed, impacting sites connected to UpdraftCentral, with a link to a detailed blog post for further information.

    0001044
    542 followersView on X
  • IntegSec@integ_sec
    Patch

    CVE-2026-10795: UpdraftPlus WordPress Plugin Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04p994F0

    Post summary

    The text announces an authentication bypass vulnerability in the UpdraftPlus WordPress plugin and hints at response actions, but does not provide PoC, exploit code, or confirmed active exploitation.

    0000037
    31 followersView on X
  • Donweb Media@DonwebMedia
    Patch

    Ojito: UpdraftPlus tiene un CVE-2026-10795 que permite ejecución remota sin credenciales. 3M de sitios expuestos. Parche disponible. Actualizá. https://seguridadenwordpress.com/cve-2026-10795-updraftplus-authentication-bypass/ #WordPress #UpdraftPlus

    Post summary

    UpdraftPlus CVE‑2026‑10795 enables unauthenticated remote code execution, exposing over 3 million sites; a patch is available and an update is strongly recommended.

    0000052
    4 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-10795 (CVSS 8.1): UpdraftPlus WordPress plugin vulnerable to auth bypass through 1.26.4. Update promptly if in use. Need a readiness check? http://adkcyber.com via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/8P0AJFUTdy

    Post summary

    The tweet focuses on CVE-2026-10795 in the UpdraftPlus plugin, urging users to apply the update promptly and providing a readiness‑check link, thus functioning mainly as a patch advisory.

    0000081
    93 followersView on X
  • Atomic Edge@atomicedgeWAF
    PoC

    https://atomicedge.io/cve-proof/cve-2026-10795-updraftplus-version-1-26-4-high-vulnerability-proof-of-concept CVE-2026-10795 updraftplus (CVSS Score 8.1) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cyb…

    Post summary

    The message highlights a proof‑of‑concept for CVE‑2026‑10795 affecting UpdraftPlus (v1.26.4) with a CVSS score of 8.1, while providing no exploit code, patch information, or evidence of active exploitation.

    0000051
    8 followersView on X
  • Andre Gironda@AndreGironda
    PoC

    CVE-2026-10795 Auth Bypass and RCE in UpdraftPlus WordPress Plugin forges unauth UpdraftPlus RPC requests as admin to upload malicious zip plugins -- https://github.com/izxci/CVE-2026-10795

    Post summary

    A proof of concept for an authentication bypass and remote code execution in UpdraftPlus is demonstrated via a GitHub-hosted PoC that exploits forged RPC requests to upload malicious plugins.

    00000119
    3.8K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-10795 The UpdraftPlus: WP Backup &amp; Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the Updraft… https://www.cve.org/CVERecord?id=CVE-2026-10795 ----- Traducción: CVE-2026-10795 El … http://infoflow.cloud`

    Post summary

    The post announces an authentication bypass vulnerability (CVE-2026-10795) in UpdraftPlus WordPress plugin affecting versions up to 1.26.4, without providing PoC, exploit code, or patch details.

    0000039
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-10795 The UpdraftPlus: WP Backup &amp; Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the Updraft… https://www.cve.org/CVERecord?id=CVE-2026-10795

    Post summary

    The CVE-2026-10795 affects the UpdraftPlus WordPress plugin up to version 1.26.4, allowing attackers to bypass authentication.

    00000242
    57.6K followersView on X
  • ASTRAL@MeAstraL
    Patch

    Critical Unauthenticated Remote Code Execution #RCE #Vulnerability Patched in #UpdraftPlus #WordPress Plugin #⃣CVSS Rating : 8.1(High) 📷CVE-ID : CVE-2026-10795 📷Patched Version : 1.26.5✅

    Post summary

    A critical unauthenticated RCE vulnerability (CVE‑2026‑10795) in the UpdraftPlus WordPress plugin has been patched in version 1.26.5 with a CVSS score of 8.1.

    0000078
    367 followersView on X

Explore more

Back to dashboard