{"id":24891,"date":"2026-06-12T08:08:27","date_gmt":"2026-06-12T08:08:27","guid":{"rendered":"https:\/\/newblog.siteground.com\/en\/?p=24891"},"modified":"2026-06-12T08:08:29","modified_gmt":"2026-06-12T08:08:29","slug":"critical-updraftplus-vulnerability-patched","status":"publish","type":"post","link":"https:\/\/www.siteground.com\/blog\/critical-updraftplus-vulnerability-patched\/","title":{"rendered":"Critical UpdraftPlus Vulnerability Patched Across All SiteGround WordPress Hosted Sites"},"content":{"rendered":"\n

If your website uses the UpdraftPlus backup plugin, here is the short version: a critical vulnerability was discovered in the plugin, and we have already updated it to the patched version on all affected sites we host. You are protected, and there is nothing you need to do.<\/p>\n\n\n\n

Below is what happened, what we did, and what to keep an eye on.<\/p>\n\n\n\n

<\/span>Your site is already protected<\/strong><\/span><\/h2>\n\n\n\n

On June 11, 2026, our engineering team force-updated the UpdraftPlus plugin across all hosted sites running a vulnerable version. Every affected installation was moved to version 1.26.5, which contains the official fix. More than 128 000  sites on our platform were running a vulnerable version, and all of them have been patched.<\/p>\n\n\n\n

We tested the upgrade paths before rolling anything out and found no issues. We do not expect any site breakages as a result of this update.<\/p>\n\n\n\n

<\/span>What the vulnerability is<\/strong><\/span><\/h2>\n\n\n\n

The flaw, tracked as CVE-2026-10795<\/a>, is an Unauthenticated Authentication Bypass affecting UpdraftPlus versions up to 1.26.4. In plain terms, it allowed attackers to gain administrator access to a WordPress site without knowing any username or password. From there, they could execute code on the site, which is about as serious as a plugin vulnerability gets.<\/p>\n\n\n\n

The “unauthenticated” part is what makes this critical. Many vulnerabilities require an attacker to already have some level of access, like a subscriber or contributor account. This one required nothing at all. Any site running a vulnerable version was exposed to anyone who knew about the flaw.<\/p>\n\n\n\n

<\/span>What we did and when<\/strong><\/span><\/h2>\n\n\n\n

As soon as the vulnerability was disclosed, it took our team less than an hour to proactively complete the update of the patched version of the plugin to all affected sites, acting immediately to close the exposure window before attackers could exploit it at scale, rather than waiting for site owners to update manually, or be affected in any way.<\/p>\n\n\n\n

Here is what the response looked like:<\/p>\n\n\n\n