Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore

Wordfence Intelligence   >   Vulnerability Database   >   Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore
5.3
Insertion of Sensitive Information into Log File
CVSS 5.3 (Medium)
Publicly Published March 8, 2023
Last Updated January 22, 2024

Description

The Updraft Plus plugin for WordPress is vulnerable to information disclosure in versions up to, and including, 1.22.24. This is due to the fact that the 'updraft_ajaxrestore' function generates a log file containing system configuration information. This makes it possible for unauthenticated attackers to trigger generation of such a log file, though it is only possible to access it on configurations that do not respect the "deny from all" directive.

References

Share

Vulnerability Details for UpdraftPlus: WP Backup & Migration Plugin

UpdraftPlus: WP Backup & Migration Plugin

Software Type Plugin
Software Slug updraftplus (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.23.1, or a newer patched version
Affected Version
  • <= 1.22.24
Patched Version
  • 1.23.1

Recent vulnerabilities in UpdraftPlus: WP Backup & Migration Plugin

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
9.8
CVE-2026-10795
Jun 10, 2026
Researcher: vtim
UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
6.1
CVE-2025-0215
Jan 15, 2025
Researcher: Asaf Mozes
UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
8.8
CVE-2024-10957
Jan 3, 2025
Researcher: Webbernaut
UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update
5.4
CVE-2023-5982
Nov 7, 2023
Researcher: Nicolas Decayeux
UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage
6.1
CVE-2023-32960
May 18, 2023
Researcher: Rafie Muhammad
UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler
8.8
CVE ID Unknown
Mar 16, 2023
Researchers:
UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting
6.1
CVE-2022-0864
Apr 7, 2022
Researcher: Taurus Omar
UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure
6.5
CVE-2022-0633
Feb 17, 2022
Researcher: Marc-Alexandre Montpas
UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore
6.1
CVE-2021-25089
Dec 28, 2021
Researcher: ZhongFu Su
UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting
6.1
CVE-2021-25022
Dec 6, 2021
Researcher: Krzysztof Zając
# Title CVE ID CVSS Researchers Date
1 UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc CVE-2026-10795 9.8 vtim June 10, 2026
2 UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting CVE-2025-0215 6.1 Asaf Mozes January 15, 2025
3 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection CVE-2024-10957 8.8 Webbernaut January 3, 2025
4 UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update CVE-2023-5982 5.4 Nicolas Decayeux November 7, 2023
5 UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage CVE-2023-32960 6.1 Rafie Muhammad May 18, 2023
6 UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler 8.8 March 16, 2023
7 UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting CVE-2022-0864 6.1 Taurus Omar April 7, 2022
8 UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure CVE-2022-0633 6.5 Marc-Alexandre Montpas February 17, 2022
9 UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore CVE-2021-25089 6.1 ZhongFu Su December 28, 2021
10 UpdraftPlus WordPress Backup Plugin <= 1.16.65 - Reflected Cross-Site Scripting CVE-2021-25022 6.1 Krzysztof Zając December 6, 2021
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation