Description

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-27T06:17:26.837Z",
  "pubdate": "2026-08-27T06:17:26.837Z",
  "executiveSummary": "The UpdraftPlus: WP Backup & Migration Plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in its backup management functionality.\nThis vulnerability allows an unauthenticated remote attacker to trigger a backup restoration process without explicit authorization from an administrator.\nThe impact is significant, as successful exploitation enables the forced reversion of the WordPress site's database and file system to a previous state held in a backup, potentially leading to data loss or the re-introduction of known vulnerabilities present in older versions.\nThe vulnerability affects UpdraftPlus versions prior to 1.26.7.\nExploitation requires that a logged-in administrator visits a malicious or attacker-controlled website while the administrative session for the WordPress site is active.\nThere is no requirement for direct server access by the attacker; the attack relies entirely on the client-side execution of a forged request executed by the victim's browser.",
  "technicalDetails": "The root cause of this vulnerability is the absence of adequate nonce verification or cross-site request forgery (CSRF) protection mechanisms within specific administrative backup management actions.\nIn the affected versions of the UpdraftPlus plugin, the endpoint responsible for initiating the restoration of site backups fails to validate the origin of the request or the intent of the current user via a cryptographically secure token.\nThe attack flow begins when an attacker crafts a malicious URL or a hidden HTML form that invokes the specific restoration function within the UpdraftPlus plugin. This payload is then delivered to an authenticated administrator, typically through social engineering, such as an email, a forum post, or a malicious third-party website.\nWhen the logged-in administrator interacts with the malicious content, their browser automatically includes the necessary authentication cookies and session identifiers for the target WordPress site. The browser then executes the request to the UpdraftPlus plugin, which processes the action as if it were intentionally triggered by the administrator.\nBecause the plugin lacks CSRF protection, the server-side application accepts the request and initiates the restoration process using the specified backup parameters defined in the attacker's payload. This action bypasses the need for the administrator to manually interact with the plugin's dashboard or provide explicit confirmation for the restoration.\nThe post-exploitation impact is severe. By forcing a site restoration, the attacker can effectively 'rewind' the WordPress environment to an earlier state. This can be used to destroy current data, reset security configurations, or revert the site to a version that contains previously patched vulnerabilities that the attacker can then exploit. This manipulation essentially disrupts site operations and compromises the integrity of the data stored within the WordPress instance."
}