{"id":"CVE-2026-82841","revision":"95b77976d4a7439f80a36c0750dc1c7a","records":[{"revision":"95b77976d4a7439f80a36c0750dc1c7a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-82841","aliases":[],"title":"UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice","description":"The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 2.26.8.26 does not have any capability check in a routine that outputs its stored remote storage settings into admin pages when the site is left in a particular post-migration state, allowing any authenticated user, such as a subscriber, to retrieve the credentials of the configured backup destinations, such as passwords and secret keys.","state":0,"publishedAt":"2026-09-27T06:00:19.369+00:00","modifiedAt":"2026-09-28T00:48:09.261+00:00","affected":[{"ecosystem":"Vendor product","name":"UpdraftPlus: WP Backup & Migration Plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"UpdraftPlus: WP Backup & Migration Plugin\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"1.23.8\",\n                            \"lessThan\": \"1.26.8\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"Vendor product","name":"UpdraftPlus: WP Backup & Migration Plugin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"UpdraftPlus: WP Backup & Migration Plugin\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"2.23.8\",\n                            \"lessThan\": \"2.26.8.26\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/52f39a82-89ee-43f1-ba9c-3ea646fb0a0e/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82841","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-82841","identifiers":["CVE-2026-82841"]},"retained":false,"historicalAffected":[]}],"coverage":[]}