UpdraftPlus is one of the most popular WordPress backup plugins, with over 3 million active installations. In versions before 1.26.5, it contained a critical authentication bypass vulnerability that allowed unauthenticated attackers to restore arbitrary backups to a site.
If you’re running UpdraftPlus on any of your WordPress sites, you need to update immediately.
What the vulnerability does
The vulnerability exists in UpdraftPlus’s AJAX restore handlers. The plugin exposes two AJAX actions to unauthenticated users: updraft_ajaxrestore and updraft_ajaxrestore_continue.
The first action (updraft_ajaxrestore) includes a nonce check, which is good. But the continuation action (updraft_ajaxrestore_continue) does not. Once a restore operation is initiated, an attacker can continue it without any authentication or nonce validation.
This means an attacker can:
- Restore a malicious backup containing backdoored plugins or themes
- Restore database backups to overwrite user data or create new admin accounts
- Exfiltrate backup files from the server
- Completely take over the site
The attack requires only a valid nonce, which is trivial to obtain from any public page on the site.
How to check if you’re affected
Check your UpdraftPlus version in the WordPress admin dashboard under Plugins. You’re vulnerable if you’re running any version before 1.26.5
If you’re on 1.26.5 or later, you’re patched.
What to do about it
Update immediately. Go to your WordPress dashboard, navigate to Plugins, and update UpdraftPlus to the latest version (1.26.5 or later).
If you can’t update right now: – Disable UpdraftPlus temporarily via the Plugins page – If you need backups running, use a different backup plugin temporarily – Monitor your site’s activity logs for any suspicious restore operations
If you’re managing multiple WordPress sites, this is a good reminder to set up automated plugin update notifications. Tools like Vulnz can monitor your plugins and alert you when vulnerabilities like this are disclosed, so you can patch before attackers find your sites.
The technical detail
The vulnerability is in how UpdraftPlus validates restore requests. The updraft_ajaxrestore action checks the nonce, but then calls prepare_restore(), which handles both the initial restore and continuation requests.
The code explicitly acknowledges this gap with a comment: “unlike updraft_ajaxrestore which requires nonce to start a new restoration, updraft_ajaxrestore_continue doesn’t require nonces at all so additional checks are required.”
But those additional checks don’t exist. The only validation is whether a restore is already in progress and the job ID matches. An attacker can simply craft a POST request with a valid job ID and continue the restore without any authentication.
The fix in 1.26.5 adds proper nonce validation to the continuation action, closing the gap.