Critical UpdraftPlus CVE-2026-10795 Exploit Targets Millions

A critical authentication-bypass flaw (CVE-2026-10795) in the UpdraftPlus WordPress plugin's UpdraftCentral integration allows unauthenticated attackers to forge encrypted RPC requests, upload malicious plugins, and achieve full site takeover; the issue affects over three million active installations and is being actively attacked (Wordfence reported ~4,987 blocks in 24 hours). The vendor released a patch that fixes the decryption/validation logic, and administrators are strongly urged to update immediately to prevent compromise.