CVE-2026-10795 Turns a Trusted Remote Connection Into an Attack Path
UpdraftPlus supports remote backup, migration, and site-management operations through its UDRPC communications layer. CVE-2026-10795 affects free releases through 1.26.4 and applies only when the site has an active UpdraftCentral key or, for paid installations, an active Migrator key. The listener is reachable without a WordPress session. An attacker who satisfies the vulnerable protocol conditions can forge a message for an existing connection and make the listener process it as the WordPress user stored with that key. This is an authentication failure rather than a missing nonce: the cryptographic message checks are supposed to establish that a trusted remote system sent the command, but the vulnerable path permits an outsider to bypass them. The resulting administrator-level command execution accounts for the 8.1 CVSS score and high severity rating.
The Legacy Message Format Skips Signature Verification
The attack begins with a POST request containing `format`, `key_name`, and `udrpc_message`. `wp_loaded()` accepts protocol formats 1 and 2, but vulnerable code checks the message signature only when `format >= 2`. Selecting legacy format 1 therefore removes the signature gate before decryption. The request must still correspond to an active remote connection and produce a message that passes the listener's key-name, time-window, and command checks, which is why the published CVSS vector rates attack complexity as high. Those later structural checks do not restore authentication: once format 1 has skipped signature verification, they validate the shape and freshness of attacker-controlled content rather than proving who sent it.
A Failed RSA Decryption Becomes a Predictable Encryption Key
The second defect is in `decrypt_message()`. UpdraftPlus extracts an encrypted symmetric key from the submitted message and asks phpseclib to decrypt it with the site's private key. An invalid value can make that RSA operation return `false`. Version 1.26.4 does not test the return value before calling `setKey()`, so the failure is coerced into predictable all-zero key material for the symmetric decryption step. An attacker can construct ciphertext for that predictable state and recover a JSON command that the listener accepts. The 1.26.5 correction rejects `false`, non-string, and undersized symmetric keys, rejects a decrypted message unless it is a string, and limits legacy format 1 to narrowly defined migration commands and key names.
A Trojan Plugin ZIP Can Execute as the Connected Administrator
After decoding the forged message, the UpdraftCentral listener retrieves the `user_id` associated with the remote key and calls `wp_set_current_user()` before dispatching the requested command. A key connected by an administrator therefore gives plugin-management commands the administrator's `install_plugins` and `activate_plugins` capabilities. The attacker can use that context to send a plugin upload, have WordPress unpack the ZIP beneath the plugins directory, and activate its entry point. The archive itself is only a delivery container; remote code execution occurs when attacker-controlled PHP from the installed plugin is loaded or activated. That code may then access WordPress core behavior, the database, and the filesystem with the privileges available to the site process.
BitFire Stops the Forged Request and the PHP File Outcome
Automated exploitation requires an unknown client or impersonated browser to send attacker-controlled RPC POST values, including `format`, `key_name`, and `udrpc_message`. BitFire bot protection detects unknown automation and browser impersonation when those clients submit unknown GET or POST parameters, allowing it to reject the request before WordPress loads `wp_loaded()` and dispatches the forged command. If a request reaches the vulnerable listener through another vector, BitFire PRO RASP supplies an independent runtime boundary. Its filesystem policy prevents unauthorized PHP file creation or modification from any request path. Unpacking a Trojan plugin ZIP must create attacker-controlled PHP inside the plugins directory, so RASP blocks the operation required to turn the authentication bypass into persistent plugin code. This is outcome protection, not a claim that the WAF treats every authorization flaw as a malicious payload.
Conclusion: Protect Privileged Plugin Installation Beyond the RPC Protocol
UpdraftPlus disclosed the issue on June 10, 2026, and its changelog identifies free version 1.26.5 as the security correction; paid administrators should use the corresponding corrected release supplied for their edition. Administrators can also inventory active UpdraftCentral and Migrator connections, remove keys that are no longer required, review requests containing `udrpc_message`, and inspect the plugins directory for unexpected additions. CVE-2026-10795 demonstrates why site administrators need a security solution with built-in access controls and zero-day protection when a plugin's cryptographic authentication fails. BitFire's behavior-based bot controls can stop unknown automated RPC clients before vulnerable code runs, while PRO RASP prevents the unauthorized PHP creation needed to install the Trojan plugin even before a vulnerability-specific signature exists.
