UpdraftPlus: WP Backup & Migration Plugin: Post-migration backup credential disclosure
UpdraftPlus free versions 1.23.8 to before 1.26.8 and paid versions 2.23.8 to before 2.26.8.26 can expose stored remote-storage settings in admin pages without a capability check when left in a particular post-migration state. Any authenticated user, including a Subscriber, can retrieve affected destination passwords or secret keys. The export does not specify the routine, request path or precise migration-state condition, so this must not be presented as affecting every installation or every storage provider.
- Component
- UpdraftPlus: WP Backup & Migration Plugin
- Plugin slug
updraftplus- Affected
- 1.23.8 to < 1.26.8, 2.23.8 to < 2.26.8.26
- Safe version
1.26.8, 2.26.8.26- Published
- Sep 27, 2026
This CVE was published Sep 27, 2026 and is one of 14 known issues for this plugin.
Update, patch or deactivate.
Update the free edition to 1.26.8 or the paid edition to 2.26.8.26, or a later supported release in the corresponding edition. Restrict settings output to authorized backup administrators and never include secrets in notices visible to lower-privileged users. Complete outstanding migration cleanup, audit access to backup destinations and rotate any exposed credentials. The two edition-specific version numbers are not interchangeable.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N