Security News > 2022 > February > Severe WordPress Plug-In UpdraftPlus Bug Threatens Backups

The WordPress plug-in "UpdraftPlus" was patched on Wednesday to correct a vulnerability that left sensitive backups at risk, potentially exposing personal information and authentication data.

UpdraftPlus is a tool for creating, restoring and migrating backups for WordPress files, databases, plug-ins and themes.

According to its website, UpdraftPlus is used by more than three million WordPress websites, including those from organizations like Microsoft, Cisco and NASA. The Bug.

According to a security bulletin posted by UpdraftPlus on Wednesday, the zero day allowed "Any logged-in user on a WordPress installation with UpdraftPlus active to exercise the privilege of downloading an existing backup, a privilege which should have been restricted to administrative users only."

As outlined by WordPress security analysts at Wordfence,the attack starts with the WordPress heartbeat function.

Security flaws in WordPress plug-ins have become the dernier cri in web security in recent months.

News URL

https://threatpost.com/severe-wordpress-plug-in-updraftplus-bug-threatens-backups/178528/