The vulnerability is an authentication bypass in the UpdraftPlus plugin that allows an attacker to forge RPC requests because signature verification is insufficient and the decryption key becomes all zeros. This flaw enables an unauthenticated user to execute arbitrary commands on the WordPress site with the privileges of the WordPress administrator, such as uploading and activating malicious plugins, which results in remote code execution. The weakness is classified as CWE‑347.

The affected product is the UpdraftPlus: WP Backup & Migration Plugin developed by David Anderson. Versions up to and including 1.26.4 are vulnerable. Any WordPress site that has this plugin installed and has UpdraftCentral remote communication enabled is potentially exposed.

The CVSS score of 8.1 indicates a high impact, while the EPSS score is not available, so the current exploitation likelihood cannot be quantified. Because the attack requires an unauthenticated RPC call to the plugin, the likely attack vector is a network‑visible endpoint that accepts remote communication requests. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS and potential for remote code execution mean that sites should treat it as a high‑risk issue. Affected sites with the plugin pre‑1.26.5 should immediately remediate.