CVE-2026-82841
UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
| Vendor | unknown |
| Product | updraftplus: wp backup & migration plugin |
| Published | Sep 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown updraftplus: wp backup & migration plugin
Be the first to know when new unknown vulnerabilities affecting unknown updraftplus: wp backup & migration plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / UpdraftPlus: WP Backup & Migration Plugin
1.23.8 < 1.26.8
Unknown / UpdraftPlus: WP Backup & Migration Plugin
2.23.8 < 2.26.8.26
References
Credits
Jakub Herman WPScan