Authentication Bypass in UpdraftPlus
UpdraftPlus is one of the most popular WordPress backup plugins, with over 3 million active installations. In versions before 1.26.5, it contained a critical authentication bypass vulnerability that allowed unauthenticated attackers to restore arbitrary backups to a site.
13 June 2026
Read moreArbitrary file move in MW WP Form lets attackers take over your site
MW WP Form versions up to and including 5.1.0 have a path traversal vulnerability that let attackers completely take over your site. It's a common pattern, with this plugin when file uploads are enabled.
3 April 2026
Read more