CVE-2026-82841: UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UpdraftPlus: WP Backup & Migration Pluginto a version that resolves this vulnerability.Fixed in 1.26.8 - Upgrade
Upgrade
UpdraftPlus: WP Backup & Migration Pluginto a version that resolves this vulnerability.Fixed in 2.26.8.26
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker only needs an authenticated WordPress account. The affected routine lacks a capability check, so low-privileged users such as subscribers can access it when the site is in the relevant post-migration state.
What information could be exposed?
Stored settings for configured remote backup destinations may be displayed in admin pages. This can include passwords, secret keys, and other remote storage credentials.
Which versions should be updated?
Update the 1.x branch to 1.26.8 or later, or the 2.x branch to 2.26.8.26 or later. Versions before those releases are affected when the specified post-migration condition exists.