CVE-2026-82841: UpdraftPlus: WP Backup & Migration Plugin, изтичане на

Описание

Оригинално описание

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.

Засегнати продукти

• Unknown UpdraftPlus: WP Backup & Migration Plugin: 1.23.8 преди 1.26.8
• Unknown UpdraftPlus: WP Backup & Migration Plugin: 2.23.8 преди 2.26.8.26

Вид слабост

• CWE-200 Разкриване на чувствителна информация пред неоторизирана страна

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-82841
• https://nvd.nist.gov/vuln/detail/CVE-2026-82841
• https://wpscan.com/vulnerability/52f39a82-89ee-43f1-ba9c-3ea646fb0a0e/