CVE-2026-76549

Name of the Vulnerable Software and Affected Versions UpdraftPlus: WP Backup & Migration Plugin versions prior to 1.26.7

Description Cross-Site Request Forgery (CSRF) occurs when a web application fails to verify that a request was intentionally initiated by the user. The plugin lacks CSRF checks in a backup management action, allowing an attacker to trick a logged-in administrator into restoring an existing backup through a crafted link. This action reverts the site database and files to a previous state.

Recommendations Update UpdraftPlus: WP Backup & Migration Plugin to version 1.26.7 or later.