CVE-2026-76549
Received Received - Intake

CSRF in UpdraftPlus WordPress Plugin

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: WPScan

Description
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-76549
EUVD
EUVD-2026-66877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
updraftplus wp_backup_and_migration_plugin to 1.26.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76549 is a Cross-Site Request Forgery (CSRF) vulnerability in the UpdraftPlus WordPress plugin versions before 1.26.7. It allows attackers to trick a logged-in admin into restoring an existing backup via a crafted link, which reverts the site's database and files to an earlier state.

Detection Guidance

Check the installed version of the UpdraftPlus plugin in WordPress. If it is below 1.26.7, the system is vulnerable. Logs may show suspicious admin actions like backup restorations without user initiation.

Impact Analysis

This vulnerability could lead to data loss or unauthorized changes by restoring the website to an outdated state. Attackers might exploit it to revert critical files or database entries, potentially disrupting site functionality or exposing sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized changes in a website's database and files by reverting to an earlier state. Such unauthorized modifications may result in data loss or corruption, which could violate compliance requirements under GDPR or HIPAA if personal or sensitive data is affected.

Mitigation Strategies

Update the UpdraftPlus plugin to version 1.26.7 or later immediately. Review recent backup restorations for unauthorized changes. Monitor admin activity for unexpected actions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76549. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart