WordPress plugin · updraftplus
Is UpdraftPlus safe?
Safe on 1.26.14 or newer.
The current version, 1.26.14, is past every affected range on record (13 of 14 records list one; 1 doesn’t, so check it below). Keep it updated and you’re clear of them.
- Flaws on record
- 14
- High or critical
- 5
- Exploited
- none
- Current version
- 1.26.14
- Last updated
- Oct 26, 2026
- Active installs
- 4,000,000+
Every recorded flaw
- Aug 27, 2026UpdraftPlus: WP Backup & Migration: Does not have CSRF checks in one of its backup management actionsCVE-2026-76549 · fixed in 1.26.7 · reported by WPScanMedium 5.9
- Jun 11, 2026UpdraftPlus: WP Backup & Migration: Authentication BypassCVE-2026-10795 · affects up to 1.26.4 · reported by Wordfence4.3% oddsHigh 8.1
- Jan 15, 2025UpdraftPlus: WP Backup & Migration: Reflected Cross-Site ScriptingCVE-2025-0215 · affects up to 1.24.12 · reported by WordfenceMedium 6.1
- Jan 4, 2025UpdraftPlus: WP Backup & Migration: PHP Object InjectionCVE-2024-10957 · reported by WordfenceHigh 8.8
- Nov 7, 2023UpdraftPlus: WordPress Backup & Migration: Cross-Site Request ForgeryCVE-2023-5982 · affects up to 1.23.10 · reported by WordfenceMedium 5.4
- Jun 22, 2023Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide CrossCVE-2023-32960 · affects up to 1.23.3 · reported by PatchstackHigh 7.1
- Apr 4, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_interval parameter before outputting it back in an admin pageCVE-2022-0864 · fixed in 1.22.9 · reported by WPScan7.4% oddsMedium 6.1
- Feb 1, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the updraft_restore parameter before outputting it back in the Restore pageCVE-2021-25089 · fixed in 1.16.69 · reported by WPScanMedium 6.1
- Jan 24, 2022UpdraftPlus WordPress Backup: Does not sanitise its updraft_service settingsCVE-2021-24423 · fixed in 1.6.59 · reported by WPScanMedium 4.8
- Jan 3, 2022UpdraftPlus WordPress Backup: Does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pagesCVE-2021-25022 · fixed in 1.16.66 · reported by WPScan1.2% oddsMedium 6.1
- Aug 28, 2019The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.CVE-2017-18593 · fixed in 1.13.5 · reported by MITREMedium 6.1
- Aug 28, 2019The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().CVE-2015-9360 · fixed in 1.9.64 · reported by MITREMedium 6.1
- Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/adCVE-2017-16871 · affects up to 1.13.12 · reported by MITRE1.6% oddsHigh 8.1
- Nov 17, 2017The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget sCVE-2017-16870 · affects up to 1.13.12 · reported by MITREHigh 8.1
Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.