Executive Summary
Beginning in July 2026, threat actors have been observed exploiting CVE-2026-10795, a critical authentication bypass vulnerability in the UpdraftPlus WordPress plugin. The attack involves forging remote management requests that leverage a predictable AES encryption state (zeroed key and IV) to bypass authentication. This allows the attacker to utilize the `plugin.upload_plugin` command to install malicious PHP payloads.
The technical analysis reveals a multi-stage process where attackers upload a ZIP file containing a PHP webshell, followed by automated verification GET requests to confirm the backdoor is reachable. Two variants of the payload have been identified: a small 3.6KB webshell and a larger 19.7KB form disguised as a database cache handler. Both implementations provide OS command execution, file management, and unauthenticated reachability markers.
This campaign is significant due to the high volume of automated delivery attempts targeting diverse edge personas. Organizations using UpdraftPlus must prioritize upgrading to version 1.26.5 (free) or 2.26.5 (Premium) immediately. Simply patching will not remove existing backdoors; therefore, forensic inspection of the `wp-content/plugins/` directory for randomized seven-letter directory names (e.g., `wp_zmfjlow`) is essential.