UpHeron
All vulnerabilities

Servers and applications · WordPress plugins

CVE-2017-16871

UpdraftPlus: WP Backup & Migration Plugin: Code Injection

Severity
High 8.1
Published
17 Nov 2017
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Also known as
WPV-095beee30517
Sources
NVD, WPVulnerability

Description

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the plupload_action function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross a privilege boundary

Affected software

SoftwareAffected versions
UpdraftPlusServers and applications · cpe:a:updraftplus:updraftplus
  • Every version up to 1.13.12
UpdraftPlusWordPress plugins · wp-plugin:updraftplus
  • Every version up to 1.13.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-16871
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-16871