UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2017-16870

UpdraftPlus: WP Backup & Migration Plugin: Server-Side Request Forgery (SSRF)

Severity
High 8.1
Published
17 Nov 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Also known as
WPV-bfbf1cd1052c
Sources
NVD, WPVulnerability

Description

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary

Affected software

SoftwareAffected versions
UpdraftPlusServers and applications · cpe:a:updraftplus:updraftplus
  • Every version up to 1.13.12
UpdraftPlusWordPress plugins · wp-plugin:updraftplus
  • Every version up to 1.13.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-16870
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-16870