UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion

Wordfence Intelligence   >   Vulnerability Database   >   UpdraftPlus < 1.16.59 - Authenticated (Admin+) Local File Inclusion
7.2
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CVSS 7.2 (High)
Publicly Published July 12, 2021
Last Updated January 22, 2024

Description

The UpdraftPlus plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.16.56 via the updraft_service settings. This makes it possible for authenticated attackers, with administrator-level permissions and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.

References

Share

Vulnerability Details for UpdraftPlus: WP Backup & Migration Plugin

UpdraftPlus: WP Backup & Migration Plugin

Software Type Plugin
Software Slug updraftplus (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.16.59, or a newer patched version
Affected Version
  • <= 1.16.56
Patched Version
  • 1.16.59

Recent vulnerabilities in UpdraftPlus: WP Backup & Migration Plugin

UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc
9.8
CVE-2026-10795
Jun 10, 2026
Researcher: vtim
UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting
6.1
CVE-2025-0215
Jan 15, 2025
Researcher: Asaf Mozes
UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
8.8
CVE-2024-10957
Jan 3, 2025
Researcher: Webbernaut
UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update
5.4
CVE-2023-5982
Nov 7, 2023
Researcher: Nicolas Decayeux
UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage
6.1
CVE-2023-32960
May 18, 2023
Researcher: Rafie Muhammad
UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler
8.8
CVE ID Unknown
Mar 16, 2023
Researchers:
Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore
5.3
CVE ID Unknown
Mar 8, 2023
Researchers:
UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting
6.1
CVE-2022-0864
Apr 7, 2022
Researcher: Taurus Omar
UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure
6.5
CVE-2022-0633
Feb 17, 2022
Researcher: Marc-Alexandre Montpas
UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore
6.1
CVE-2021-25089
Dec 28, 2021
Researcher: ZhongFu Su
# Title CVE ID CVSS Researchers Date
1 UpdraftPlus: WP Backup & Migration Plugin <= 1.26.4 (free) < 2.26.5 (premium) - Unauthenticated Authentication Bypass via UpdraftCentral udrpc CVE-2026-10795 9.8 vtim June 10, 2026
2 UpdraftPlus - Backup/Restore <= 1.24.12 - Reflected Cross-Site Scripting CVE-2025-0215 6.1 Asaf Mozes January 15, 2025
3 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection CVE-2024-10957 8.8 Webbernaut January 3, 2025
4 UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update CVE-2023-5982 5.4 Nicolas Decayeux November 7, 2023
5 UpdraftPlus <= 1.23.3 - Cross-Site Request Forgery to Cross-Site Scripting via action_authenticate_storage CVE-2023-32960 6.1 Rafie Muhammad May 18, 2023
6 UpdraftPlus 1.22.14 to 1.23.2 and UpdraftPlus (Premium) 2.22.14 to 2.23.2 - Privilege Escalation via updraft_central_ajax_handler 8.8 March 16, 2023
7 Updraft Plus <= 1.22.24 - Information Disclosure via updraft_ajaxrestore 5.3 March 8, 2023
8 UpdraftPlus WordPress Backup Plugin < 1.22.9 Reflected Cross-Site Scripting CVE-2022-0864 6.1 Taurus Omar April 7, 2022
9 UpdraftPlus WordPress Backup Plugin < 1.22.3 - Sensitive Information Disclosure CVE-2022-0633 6.5 Marc-Alexandre Montpas February 17, 2022
10 UpdraftPlus WordPress Backup Plugin <= 1.16.68 - Reflected Cross-Site Scripting via updraft_restore CVE-2021-25089 6.1 ZhongFu Su December 28, 2021
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation