Loading vulnerability…
CVE-2026-10795 is an authentication bypass vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress affecting all versions up to and including 1.26.4, including equivalent premium builds, and also affecting standalone UpdraftCentral versions prior to 0.8.32. The flaw is in the UpdraftCentral remote management communications path, specifically the UpdraftPlus_Remote_Communications_V2::wp_loaded function. The issue arises from insufficient validation of the remote communications message format and improper verification of cryptographic protections. Signature verification can be bypassed, and a failed RSA decryption result is not properly validated before being used as input to symmetric encryption handling. As a result, decryption failure can collapse the session state to a predictable all-zero AES key and initialization vector, allowing an attacker to craft forged RPC payloads that the listener accepts as valid. Once accepted, the forged RPC commands are executed in the security context of the connected administrator. This can be abused to upload and activate a malicious plugin, resulting in unauthenticated remote code execution on the vulnerable WordPress site.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a self-contained Docker lab and Python PoC for CVE-2026-10795 affecting the UpdraftPlus WordPress plugin’s UpdraftCentral RPC layer. The repo contains 8 files: a large README documenting the vulnerability and lab workflow, docker-compose.yml to orchestrate vulnerable and patched WordPress stacks, two Dockerfiles that build WordPress images with UpdraftPlus 1.26.4 and 1.26.5 respectively, a shell setup script that installs/configures WordPress and seeds an UpdraftCentral key state, a Python PoC, and a minimal requirements file. The main exploit logic is in poc/poc.py. It is a host-side Python script using requests and pycryptodome. It constructs a forged UpdraftCentral RPC message by embedding JSON fields such as command, time, key_name, and rand; encrypting that JSON with AES-CBC using a zero key and zero IV; and prepending a malformed RSA block encoded as base64. The script then POSTs form fields format=1, key_name=0.central.updraftplus.com, and udrpc_message to the target root URL. It parses the HTTP response to determine whether RPC dispatch occurred. In default mode it sends plugin.upload_plugin with a generated ZIP marker plugin payload, then checks a marker REST endpoint to confirm activation and retrieve hard-coded /usr/bin/id output. In --ping mode it performs a lower-impact forged RPC validation. The exploit capability is authentication bypass leading to privileged RPC command dispatch, specifically abuse of legitimate plugin installation functionality. It is not a generic command injection or shell dropper. The demonstrated impact is RCE-style because the uploaded marker plugin exposes a proof endpoint that executes /usr/bin/id, but the repository explicitly avoids generic command parameters, reverse shells, persistence, or external callbacks. The lab infrastructure supports comparison between vulnerable and patched behavior. docker-compose.yml exposes the vulnerable WordPress instance on 8081 and the patched instance on 8082, each backed by MariaDB. The setup script activates UpdraftPlus, disables indexing, and seeds the WordPress option updraft_central_localkeys with a generated RSA keypair and metadata so that UpdraftCentral dispatch paths are reachable. Both Dockerfiles also create /usr/src/wordpress/cve-lab-inspector.php, a diagnostic endpoint that reports plugin version and presence of relevant RPC library code paths. Overall, this is a real exploit PoC for a web attack vector in a controlled local lab. It is operational rather than weaponized: it includes a working payload chain and verification logic, but it is intentionally constrained to localhost targets and a fixed marker-plugin proof of impact.
This repository is a small standalone exploit project with 2 files: a Python exploit/scanner script and a README. The main file, CVE-2026-10795-mass.py, is a concurrent mass scanner/exploit targeting a WordPress UpdraftPlus vulnerability identified as CVE-2026-10795. It is not part of a common exploitation framework. The script’s structure shows: (1) argument parsing for a targets file, thread count, and timeout; (2) helper routines for colored output and atomic result saving; (3) cryptographic helpers that build forged RPC messages using AES-CBC with an all-zero key and IV; (4) HTTP request logic that POSTs crafted parameters including udrpc_message, format=1, and key_name to target WordPress endpoints; and (5) exploitation workflow logic (partially truncated in the provided content) that appears to test targets, extract privileged account information, and deploy a malicious plugin. A notable capability is build_plugin_zip(), which dynamically creates a ZIP-packaged WordPress plugin. That plugin contains PHP code acting as a simple uploader/webshell: it displays php_uname(), renders a file upload form, and copies uploaded files into place. This indicates the exploit goes beyond detection and aims to achieve post-exploitation access/RCE on compromised sites. The primary network target pattern is the WordPress AJAX endpoint wp-admin/admin-ajax.php, with fallback posting to the site root. The exploit also cycles through several hardcoded UpdraftPlus-related key names: 0.central.updraftplus.com, 1.central.updraftplus.com, 2.central.updraftplus.com, and migrator.updraftplus.com. Local artifacts include admins.txt and uploaders.txt for harvested results. Overall, this is an operational mass-exploitation tool intended to automate vulnerable-host discovery and establish persistent malicious access via plugin upload.
This repository is a small standalone Python PoC for CVE-2026-10795 affecting UpdraftPlus: WP Backup & Migration. It contains two files: a Python exploit script (CVE-2026.10795.py) and a README describing the vulnerability, setup, and intended usage. The script is the clear entry point and implements the exploit logic directly without using an external exploitation framework. The exploit targets an unauthenticated UpdraftPlus RPC mechanism exposed on WordPress sites connected to UpdraftCentral. The core idea is to craft a forged 'udrpc_message' where the RSA-encrypted symmetric key is intentionally malformed. According to the repository’s description, the vulnerable server-side code fails to validate RSA decryption failure and passes a false value into AES key setup, collapsing to a deterministic all-zero AES-128 key. The PoC mirrors that behavior by encrypting a JSON RPC payload with AES-CBC using a zero key and zero IV, then packaging it into the expected message format: [3 hex chars key length][fake sym key][16 hex chars ciphertext length][ciphertext]. Main capabilities implemented in code are: (1) sending arbitrary RPC commands as a chosen admin user ID, (2) listing installed plugins via 'plugin.get_plugins', (3) uploading a plugin ZIP via 'plugin.upload_plugin', and (4) activating a plugin via 'plugin.activate_plugin'. The upload routine uses a placeholder ZIP blob in the script, but the README explains that a malicious plugin/webshell could be uploaded and then activated to achieve remote code execution. Because the script posts directly to the WordPress base URL and requires no authentication material in the request, the attack vector is web/network-based. Notable fingerprintable artifacts include the default target URL 'http://localhost/wordpress/', the POST parameter 'udrpc_message', the RPC command names, the plugin path 'test-shell/test-shell.php', and the README’s example webshell URL under '/wp-content/plugins/test-shell/test-shell.php?cmd=whoami'. Overall, this is a functional operational PoC rather than a mere detector: it demonstrates privilege bypass and provides the primitives necessary for plugin-based RCE on vulnerable, UpdraftCentral-connected WordPress installations.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An unauthenticated remote code execution vulnerability in the UpdraftPlus WordPress plugin.
An authentication bypass vulnerability affecting UpdraftPlus/UpdraftCentral RPC handling, where vulnerable versions process a forged RPC request and return a JSON response containing "udrpc_message". The content focuses on correcting false positives in detection logic for affected hosts.
An authentication-bypass vulnerability in the UpdraftPlus WordPress backup plugin. The article notes it is high severity, patched, and reportedly under attack, but its role in the described supply-chain compromise is unconfirmed.
Unknown
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.