WordPress force installs UpdraftPlus patch on 3 million sites

WordPress has taken the rare step of force-updating the UpdraftPlus plugin on all sites to fix a high-severity vulnerability allowing website subscribers to download the latest database backups, which often contain credentials and PII.

Three million sites use the popular WordPress plugin, so the potential for exploitation was substantial, affecting a significant share of the internet, including large platforms.

The vulnerability affects UpdraftPlus versions 1.16.7 to 1.22.2, and the developers fixed it with the release of 1.22.3 or 2.22.3 for the (paid) Premium version.

The flaw was discovered by security researcher Marc Montpas of Automattic and is tracked as CVE-2022-0633 and carries a CVSS v3.1 score of 8.5.

Flaw and exploitation

UpdraftPlus helps simplify the process of backups and restoration with scheduled backup functions and an auto-download option to a trusted email address.

However, due to bugs found in the plugin, any low-level authenticated user can craft a valid link that would allow them to download the files.

The issue is improper user validation on whether or not they have the required privileges to access a backup's nonce identifier and timestamps.

The attack starts by sending a heartbeat request containing a "data" parameter to obtain information about the most recent backup.

Having this info, the attacker triggers the "send backup via email" function after manipulating the endpoint request.

This function is normally restricted to administrators only, but anyone with an account on the target site can access it without limits due to missing the permission check.

Of course, the attacker would need to know how to download database backups, and for now, Updraft reports that they have seen no such cases in the wild.

"At this point in time, (the appearance of a PoC) relies upon a hacker reverse-engineering the changes in the latest UpdraftPlus release to work it out." - Updraft.

As noted in the Automattic report, some indirect checks were still present in the vulnerable plugin versions, but those aren't enough to stop a skilled attacker.

Timeline and fixes

The flaw was discovered on February 14, 2022, and UpdraftPlus was notified immediately, while technical details followed the next day.

The response from the developers of the popular plugin was almost immediate, and on February 16, 2022, WordPress began force-upgrading installations to version 1.22.3.

According to the WordPress download stats for this plugin, 783,000 installs were upgraded on the 16th and an additional 1.7 million were updated on the 17th.

Montpas told Bleeping Computer that this is one of those very rare and exceptionally severe cases where WordPress forces auto-updates on all sites regardless of their admins' settings.

If you want to update immediately to the secured version, you can manually apply the security update from the dashboard. The latest version available today is 1.22.4, so this is the recommended one to use.

Note that this vulnerability introduces no risks for sites that don't support user logins of any kind or don't hold any backups.

WordPress force installs UpdraftPlus patch on 3 million sites