A fatal error has been found in the WordPress backup plugin used by over 3 million sites

Patches were released to contain a “serious” vulnerability in UpdraftPlus, a WordPress plugin with more than three million installs, which can be weaponized to download private location data using an account on vulnerable sites.

“All versions of UpdraftPlus from March 2019 contain a vulnerability caused by a missing permission level check, allowing untrusted users to access backups,” the plugin maintainers said in an advisory released this week.

Security researcher Marc-Alexandre Montpas of Automattic was credited with discovering and reporting the vulnerability on February 14 for which the ID was assigned. CVE-2022-0633 (CVSS Rating: 8.5). The issue affects UpdraftPlus versions from 1.16.7 to 1.22.2.

UpdraftPlus is a file Backup and restore solution It is able to perform full, manual or scheduled backups of WordPress files, databases, plugins and themes, which can then be restored via WordPress admin control panel.

result of this Error Is that it allows any user logged in on a WordPress installation with UpdraftPlus installed to exercise the privilege to download an existing backup – permissions that should have been reserved for admin users only.

Besides leaking passwords and other confidential data, it can also “in some cases take over the site if the attacker is able to obtain the database’s credentials from the configuration file and successfully access the site’s database,” WordPress security firm Wordfence said. pointed.

UpdraftPlus users are recommended to update to version 1.22.3 (or 2.22.3 for premium version) to mitigate any potential exploit. The latest version available as of February 17th is 1.22.4, which fixes errors related to printing autosave options on PHP 8.