Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-82841

UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown UpdraftPlus: WP Backup & Migration Plugin

Default version status: unaffected

  • 1.23.8 to < 1.26.8affected

Unknown UpdraftPlus: WP Backup & Migration Plugin

Default version status: unaffected

  • 2.23.8 to < 2.26.8.26affected

References