CVE-2026-82841 UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice
Authenticated subscribers can retrieve remote storage credentials if the site is in a specific post-migration state due to missing capability checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82841?
CVE-2026-82841 is a medium-severity vulnerability in Unknown UpdraftPlus: WP Backup & Migration Plugin, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.
Weakness: CWE-200
Which versions are affected by CVE-2026-82841?
How do I fix CVE-2026-82841?
No fix has been published for CVE-2026-82841 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82841 being exploited?
There is no known exploitation of CVE-2026-82841 in the wild and no public exploit code.
Sources
Also known as GHSA-c9rv-8jhm-3c35.