Critical Vulnerability in UpdraftPlus WordPress Plugin Affects 3+ Million Sites

A high severity vulnerability in the popular UpdraftPlus WordPress plugin affects over 3 million sites, allowing unauthenticated attackers to exploit the flaw. Learn about the issue and how to secure your site.

Critical Vulnerability in UpdraftPlus WordPress Plugin Affects Over 3 Million Sites

A recently discovered high severity vulnerability in the UpdraftPlus WordPress plugin could expose millions of sites to potential attacks. Rated 8.8 on the severity scale, this flaw allows unauthenticated attackers to exploit the plugin.

UpdraftPlus: WP Backup & Migration Plugin

UpdraftPlus is a widely used WordPress plugin with over 3 million installations. It provides users with the ability to back up their websites to cloud storage or email, offering flexibility for manual and automatic backups. However, this vulnerability has put many sites at risk.

Details of the Vulnerability

According to Wordfence, the vulnerability in UpdraftPlus arises from a PHP Object Injection via the 'recursive_unserialized_replace' function, affecting versions up to 1.24.11. This flaw could potentially enable attackers to delete files, retrieve sensitive data, or execute malicious code, depending on the presence of additional plugins or themes.

Official Response and Patch

UpdraftPlus has released version 1.24.12 to address the issue, but the changelog minimizes the vulnerability, referring to it as a "tweak" rather than a security patch. Users are strongly advised to update their plugin to this latest version to protect their websites from potential exploitation.

Stay Secure

Ensure your WordPress site is safe by updating the UpdraftPlus plugin immediately. For more details on this vulnerability and steps to secure your website, visit our blog.

Keywords:

• WordPress Plugin Vulnerability
• UpdraftPlus Security Flaw
• UpdraftPlus Update
• WordPress Security Alert
• PHP Object Injection
• Protect WordPress Site
• Website Backup Plugin Vulnerability
• WordPress Plugin Security