WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in UpdraftPlus: WP Backup & Migration Plugin

Backup, restore or migrate your WordPress website to another host or domain. Schedule backups or run manually. Migrate in minutes.

20Reported vulnerabilities
9.9Highest CVSS score
1.26.6Latest version
3,000,000+Active installs

What to do now

Update UpdraftPlus: WP Backup & Migration Plugin to 1.26.7 or later. 18 of these have a fixed version available. Updating resolves them.

Plugin last updated: August 13, 2026 / Tested up to WordPress: 7.1 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-0864 Medium 6.1 7.4% Before 1.22.9 1.22.9 April 4, 2022
CVE-2017-16871 High 8.1 1.6% 1.13.12 and earlier — November 17, 2017
CVE-2017-16870 High 8.1 1.0% 1.13.12 and earlier — November 17, 2017
CVE-2021-25022 Medium 6.1 1.1% Before 1.16.66 1.16.66 January 3, 2022
CVE-2021-25089 Medium 6.1 0.8% Before 1.16.69 1.16.69 February 1, 2022
WF-c75bfba9-b25a-4966-835c-8d22736de809 Critical 9.9 — Before 1.9.51 1.9.51 February 3, 2015
CVE-2026-10795 High 8.1 3.6% 0 to 1.26.4 (inclusive) 1.26.5 June 11, 2026
CVE-2024-10957 High 8.8 0.7% 1.23.8 to 1.24.11 (inclusive) 1.24.12 January 4, 2025
CVE-2021-24423 Medium 4.8 0.6% Before 1.16.59 1.16.59 January 24, 2022
WF-2e329432-c404-4312-969b-42cac345637d High 8.8 — 1.22.14 to 1.23.2 (inclusive)
2.22.14 to 2.23.2 (inclusive)		 1.23.3 March 16, 2023
CVE-2022-0633 Medium 6.5 2.1% 1.16.7 up to (but not including) 1.22.3 1.22.3 February 17, 2022
WF-40d80e47-3411-4e70-8a20-2e698daad6e7 High 7.2 — 1.16.56 and earlier 1.16.59 July 12, 2021
CVE-2017-18593 Medium 6.1 0.9% Before 1.13.5 1.13.5 August 28, 2019
CVE-2015-9360 Medium 6.1 0.9% Before 1.9.64 1.9.64 August 28, 2019
CVE-2025-0215 Medium 6.1 0.4% 0 to 1.24.12 (inclusive) 1.25.1 January 15, 2025
CVE-2023-32960 Medium 6.1 0.2% 1.23.3 and earlier 1.23.4 June 22, 2023
WF-800a06f3-8a5b-4ba1-ad16-3d3a214f372f Medium 6.1 — 1.9.6.3 and earlier 1.9.6.4 April 20, 2015
CVE-2023-5982 Medium 5.4 0.2% 1.23.10 and earlier 1.23.11 November 7, 2023
WF-343cbdda-2ec5-437f-b563-96c61663314d Medium 5.3 — 1.22.24 and earlier 1.23.1 March 8, 2023
CVE-2026-76549 Medium 4.3 0.1% Before 1.26.7 1.26.7 August 27, 2026

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.