Is UpdraftPlus safe to use?

Laskyr does not give safety verdicts. No known unpatched vulnerabilities in the latest version (1.26.14). As of 2026-11-01. 10 issues are on record for older versions; version 1.26.8 or newer fixes all of them that state a fix. Keep UpdraftPlus on the latest version (1.26.14) and remove it if you do not use it.

Which versions of UpdraftPlus are vulnerable?

Known issues on record (newest first): Information disclosure (1.23.8 up to (not including) 1.26.8, 2.23.8 up to (not including) 2.26.8.26, fixed in 1.26.8); Cross-site request forgery (CSRF) (older than 1.26.7, fixed in 1.26.7); Remote code execution (1.26.4 and older, fixed in 1.26.5); Reflected cross-site scripting (XSS) (1.24.12 and older, fixed in 1.25.1); PHP object injection (1.23.8 to 1.24.11, fixed in 1.24.12); Cross-site request forgery (CSRF) (1.23.10 and older, fixed in 1.23.11). The full list with sources is on this page.

What is the latest version of UpdraftPlus?

1.26.14, according to wordpress.org (last updated 2026-10-26). It has 4+ million active installs.

What should I do if my UpdraftPlus is out of date?

Take a backup, then update it from Dashboard > Updates (or run wp plugin update updraftplus). If you cannot update right away, deactivate it until you can. If you think the site was already attacked, run a free scan at https://laskyr.com/scan.

Plugins · updraftplus · data as of 2026-11-01

Is UpdraftPlus safe? Known vulnerabilities and latest version

Latest version: 1.26.14
Last updated: 2026-10-26
Active installs: 4+ million
Known issues on record: 10
Unpatched in latest: 0
Tested up to WP: 7.1.4

Backup, restore or migrate your WordPress website to another host or domain. Schedule backups or run manually. Migrate in minutes. — by David Anderson / Team Updraft

What to do

Update to the latest version (1.26.14). Anything older than 1.26.8 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
If you cannot update right away, deactivate it until you can.
Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.

With WP-CLI: wp plugin get updraftplus --field=version shows what you run; wp plugin update updraftplus updates it.

Check your version

Known vulnerabilities

10 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.

medium 5.3 CVE-2026-82841 · published 2026-09-27

Information disclosure in UpdraftPlus (1.23.8 up to (not including) 1.26.8, 2.23.8 up to (not including) 2.26.8.26)

Affected: 1.23.8 up to (not including) 1.26.8, 2.23.8 up to (not including) 2.26.8.26
Fixed in: 1.26.8
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: CVE record (the advisory publisher) · score by CISA ADP

Note: the source's version range goes past the newest UpdraftPlus release on wordpress.org (1.26.14), so it probably describes a paid edition with its own version numbers, or contains a typo. We do not use it to judge your version.

Details from the advisory

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.

NVD CVE-2026-82841 WPScan advisory

medium 5.9 CVE-2026-76549 · published 2026-08-27

Cross-site request forgery (CSRF) in UpdraftPlus (older than 1.26.7)

Affected: older than 1.26.7
Fixed in: 1.26.7
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by CISA ADP

Details from the advisory

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

NVD CVE-2026-76549 WPScan advisory

high 8.1 CVE-2026-10795 · published 2026-06-11

Remote code execution in UpdraftPlus (1.26.4 and older)

Affected: 1.26.4 and older
Fixed in: 1.26.5 *
Access needed (per CVSS): No login needed
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

NVD CVE-2026-10795 Wordfence advisory Code change (fix)plugins.svn.wordpress.org plugins.svn.wordpress.org

medium 6.1 CVE-2025-0215 · published 2025-01-15

Reflected cross-site scripting (XSS) in UpdraftPlus (1.24.12 and older)

Affected: 1.24.12 and older
Fixed in: 1.25.1 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the showdata and initiate_restore parameters in all versions up to, and including, 1.24.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an admin user into performing an action such as clicking on a link.

NVD CVE-2025-0215 Wordfence advisory Plugin source

high 8.8 CVE-2024-10957 · published 2025-01-04

PHP object injection in UpdraftPlus (1.23.8 to 1.24.11)

Affected: 1.23.8 to 1.24.11
Fixed in: 1.24.12 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by Wordfence

Details from the advisory

The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions from 1.23.8 to 1.24.11 via deserialization of untrusted input in the 'recursive_unserialized_replace' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. An administrator must perform a search and replace action to trigger the exploit.

NVD CVE-2024-10957 Wordfence advisory Code change (fix)Plugin source

medium 5.4 CVE-2023-5982 · published 2023-11-07

Cross-site request forgery (CSRF) in UpdraftPlus (1.23.10 and older)

Affected: 1.23.10 and older
Fixed in: 1.23.11 *
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.

NVD CVE-2023-5982 Wordfence advisory Code change (fix)

medium 6.1 CVE-2023-32960 · published 2023-06-22

Cross-site request forgery (CSRF) in UpdraftPlus (1.23.3 and older)

Affected: 1.23.3 and older
Fixed in: 1.23.4
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: CVE record (the advisory publisher) · score by NVD

Details from the advisory

Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).

NVD CVE-2023-32960 Patchstack advisory

medium 6.5 CVE-2022-0633 · published 2022-02-17

Missing authorization check in UpdraftPlus (older than 1.22.3)

Affected: older than 1.22.3
Fixed in: 1.22.3
Access needed (per CVSS): Needs a low-level account (e.g. subscriber)
Range from: NVD analysis · score by NVD

Details from the advisory

The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.

NVD CVE-2022-0633 WPScan advisory packetstormsecurity.com jetpack.com updraftplus.com

medium 6.1 CVE-2021-25022 · published 2022-01-03

Reflected cross-site scripting (XSS) in UpdraftPlus (older than 1.16.66)

Affected: older than 1.16.66
Fixed in: 1.16.66
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues

NVD CVE-2021-25022 WPScan advisory Code change (fix)

medium 6.1 CVE-2017-18593 · published 2019-08-28

Cross-site scripting (XSS) in UpdraftPlus (older than 1.13.5)

Affected: older than 1.13.5
Fixed in: 1.13.5
Access needed (per CVSS): No login needed; someone on the site has to click a link or open a page
Range from: NVD analysis · score by NVD

Details from the advisory

The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.

NVD CVE-2017-18593 wordpress.org

Recent activity

2026-10-26 — latest release on wordpress.org (1.26.14).
2026-09-27 — Information disclosure disclosed (CVE-2026-82841), fixed in 1.26.8.
2026-08-27 — Cross-site request forgery (CSRF) disclosed (CVE-2026-76549), fixed in 1.26.7.
2026-06-11 — Remote code execution disclosed (CVE-2026-10795), fixed in 1.26.5.

Free. We check the CVE feeds every day and email you only when a new issue for UpdraftPlus (updraftplus) is published or a fix ships. Unsubscribe in one click.

Where this data comes from

Version, last update, installs: wordpress.org/plugins/updraftplus (Plugins API), fetched 2026-11-01.
Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-01. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.

Badge for your site or docs (states facts with a date, not a verdict):

<a href="https://laskyr.com/plugins/updraftplus"><img src="https://laskyr.com/plugins/updraftplus/badge.svg" alt="UpdraftPlus vulnerability status"></a>

← Check another plugin · Free hacked-site scan

Is UpdraftPlus safe? Known vulnerabilities and latest version

No known unpatched vulnerabilities in the latest version (1.26.14)

What to do

Check your version

Known vulnerabilities

Information disclosure in UpdraftPlus (1.23.8 up to (not including) 1.26.8, 2.23.8 up to (not including) 2.26.8.26)

Cross-site request forgery (CSRF) in UpdraftPlus (older than 1.26.7)

Remote code execution in UpdraftPlus (1.26.4 and older)

Reflected cross-site scripting (XSS) in UpdraftPlus (1.24.12 and older)

PHP object injection in UpdraftPlus (1.23.8 to 1.24.11)

Cross-site request forgery (CSRF) in UpdraftPlus (1.23.10 and older)

Cross-site request forgery (CSRF) in UpdraftPlus (1.23.3 and older)

Missing authorization check in UpdraftPlus (older than 1.22.3)

Reflected cross-site scripting (XSS) in UpdraftPlus (older than 1.16.66)

Cross-site scripting (XSS) in UpdraftPlus (older than 1.13.5)

Recent activity

Get an email when UpdraftPlus has a new vulnerability

Where this data comes from