CVE-2026-10795 is an authentication bypass vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress, affecting all versions up to and including 1.26.4. The vulnerability arises from improper verification of cryptographic signatures in the UpdraftPlus_Remote_Communications_V2::wp_loaded function. Specifically, insufficient validation of the remote communications message format allows attackers to bypass signature verification. Additionally, unchecked decryption return values collapse to a predictable all-zero encryption key. Exploiting this flaw enables unauthenticated attackers to forge arbitrary RPC commands executed with administrator privileges, including uploading and activating malicious plugins, ultimately resulting in remote code execution.

Successful exploitation allows unauthenticated attackers to bypass authentication, execute arbitrary RPC commands as the connected administrator, upload and activate malicious plugins, and achieve remote code execution. This compromises the confidentiality, integrity, and availability of the affected WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected plugin and monitor for suspicious activity related to remote communications. Avoid exposing the plugin's remote communication endpoints to untrusted networks.