Vulnerability Report

CVE-2026-10795

RCE

Title: Authentication Bypass Leading to RCE

RCE

Proof Of Concept

PoC Available for CVE-2026-10795

CWE Category CWE-347

Published Date Jun 11, 2026

Modified Date Jun 11, 2026

Exploit Status Available

Score 8.1 CVSS v3.1

Exploit Probability (EPSS)

1.25%

Vulnerability Summary

CVE-2026-10795: The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.26.4 via the UpdraftPlus_Remote_Communications_V2::wp_loaded function. This is due to insufficient validation of the remote communications message format, where signature verification can be bypassed and unchecked decryption return values collapse to a predictable all-zero encryption key. This makes it possible for unauthenticated attackers to forge arbitrary RPC commands and run them as the connected administrator, such as uploading and activating a malicious plugin, which ultimately leads to remote code execution.

Impacted Vendors

Analysis in Progress...

Reference Links

https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc.php https://plugins.svn.wordpress.org/updraftplus/tags/1.26.4/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php https://plugins.trac.wordpress.org/changeset/3561938/updraftplus/trunk/vendor/team-updraft/common-libs/src/updraft-rpc/class-udrpc2.php https://www.wordfence.com/threat-intel/vulnerabilities/id/e901c2a0-2477-4b9a-8483-6002419e0a2f?source=cve

CVSS v3.1

Source Entity [email protected]

Severity HIGH

8.1

Attack Vector

NETWORK

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-10795 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/izxci/CVE-2026-10795

View Code

GitHub https://github.com/webshellseo8/CVE-2026-10795-POC

View Code

GitHub https://github.com/rootdirective-sec/CVE-2026-10795-Lab

View Code

June 11, 2026 MODIFIED

Vulnerability data updated via NVD.

June 11, 2026 MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector NETWORK

Complexity HIGH

Privileges N/A

Interaction NONE

CVSS Vector String


                                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.