UpdraftPlus, the most popular WordPress backup plugin with over 3 million active installations, has been hit by several critical vulnerabilities in 2026 — including unauthenticated backup downloads and SQL injection. Here’s how to lock down your site immediately.
1. Update Immediately
The first line of defense: ensure UpdraftPlus is on the latest version. Plugin maintainers have patched CVE-2026-XXXX (backup download) and CVE-2026-XXXX (SQLi) in versions 1.24.6 and later.
# Check your version from CLI wp plugin get updraftplus --field=version # Update wp plugin update updraftplus
2. Restrict Backup Access by IP
Even on the latest version, restrict access to backup functionality to whitelisted IPs. Add this to your .htaccess or server config:
Order Deny,Allow
Deny from all
Allow from 192.168.1.0/24
Allow from 203.0.113.0/24
3. Disable Remote Storage Auto-Linking
If you use remote storage (S3, Dropbox, Google Drive), revoke and re-link the connection. Vulnerabilities have been found in OAuth token handling that could expose remote storage credentials.
“Your backup plugin should never be an attack vector. Treat it with the same scrutiny as your authentication system.”
4. Implement Web Application Firewall Rules
Use a WAF (Cloudflare, Sucuri, or ModSecurity) to block exploit attempts targeting known UpdraftPlus CVEs. Block requests containing updraftplus in query strings from non-admin paths.
5. Regular Security Audits
Use tools like WPScan to proactively scan for vulnerable plugins. Automate weekly scans and integrate results into your Slack or email alerts.
wpscan --url https://yoursite.com --plugins-detection aggressive
6. Alternative Backup Strategy
Consider using server-level backups (via cron + mysqldump or your hosting provider’s native backup) as a primary strategy, with UpdraftPlus as a secondary convenience layer — reducing the blast radius of any plugin compromise.