CVE-2017-16870

Name of the Vulnerable Software and Affected Versions UpdraftPlus plugin versions 1.13.12 and earlier

Description The issue concerns a Server-Side Request Forgery (SSRF) in the updraft ajax handler function, located in /wp-content/plugins/updraftplus/admin.php, which can be exploited via an httpget subaction. The vendor has noted that this issue does not cross a privilege boundary.

Recommendations For versions 1.13.12 and earlier, consider disabling the updraft ajax handler function as a temporary workaround until a patch is available. Restrict access to the /wp-content/plugins/updraftplus/admin.php file to minimize the risk of exploitation. Avoid using the httpget subaction in the affected API endpoint until the issue is resolved.