CVE-2026-76549: CWE-352 Cross-Site Request Forgery (CSRF) in UpdraftPlus: WP Backup & Migration Plugin

The UpdraftPlus WordPress plugin before version 1.26.7 does not implement CSRF checks on one of its backup management actions. This absence of CSRF protection enables attackers to craft malicious links that, when visited by an authenticated administrator, cause the site to restore a previous backup. This restoration can revert the database and files to an earlier state, potentially undoing recent changes or updates.

Successful exploitation requires a logged-in administrator to interact with a maliciously crafted link, resulting in the restoration of an earlier backup. This can lead to loss of recent data or configuration changes, impacting site integrity and availability. The vulnerability does not directly disclose information or allow privilege escalation but can disrupt site operations.

No official fix or patch information is currently available. Users should monitor the vendor's advisory for updates and consider restricting administrative access or implementing additional CSRF protections as interim measures. Avoid clicking on untrusted links while logged in as an administrator.