A critical vulnerability within WordPress’s popular plugin “UpdraftPlus” has been identified and patched. UpdraftPlus is a WordPress tool used by more than three million websites that allows administrators to create, restore, and migrate backups of website data, as well as the associated databases. If exploited, the flaw, tracked as CVE-2022-0633, affects all distributions from before March 2019, and allows any logged-in user on a WordPress website running the vulnerable UpdraftPlus plugin to download existing site backups that should only be available to authenticated privileged users (such as site administrators and owners). The flaw was due to an improper code validation that checks for the current backup status and could lead to the leaking of sensitive information like password credentials, user PII, and other extremely sensitive data, as well as potentially being able to take over the entire website. A spokesperson from the WordPress security company WordFence stated that it could, in some cases, lead to a “site takeover if the attacker is able to obtain database credentials from a configuration file and successfully access the site database.” For perspective, a skilled attacker could exploit this vulnerability to obtain database config files containing the administrator password, which they could then change to be whatever they want, effectively locking the administrators and engineers out of their own site. Security researchers state that a site takeover is far less likely, due to the technical difficulty of successfully exploiting the database credentials. WordPress urges all UpdraftPlus administrators to upgrade to the latest stable version immediately (advisory linked below), and Ankura CTIX analysts will continue to monitor this matter as well as report on the latest WordPress vulnerabilities and patches.