UpdraftPlus security release – 1.22.3 / 2.22.3 – please upgrade

Our new UpdraftPlus release, 1.22.3 (free version) / 2.22.3 (paid versions) is a security release. The short version is: you should update. To get the details, read on!

On the evening of February 15th, we received a security defect report from security researcher Marc-Alexandre Montpas of Automattic, who during an audit of UpdraftPlus found a previously unknown defect in current versions of UpdraftPlus, which has had a CVE identifier reserved of CVE-2022-23303.

This defect allows any logged-in user on a WordPress installation with UpdraftPlus active to exercise the privilege of downloading an existing backup, a privilege which should have been restricted to administrative users only. This was possible because of a missing permissions check on code related to checking current backup status. This allowed the obtaining of an internal identifier which was otherwise unknown, and could then be used to pass a check upon permission to download.

This means that if your WordPress site allows untrusted users to have a WordPress login, and if you have any existing backup, then you are potentially vulnerable to a technically skilled user working out how to download the existing backup. Affected sites are at risk of data loss / data theft via the attacker accessing a copy of your site’s backup, if your site contains anything non-public. I say “technically skilled”, because at that point, no public proof of how to leverage this exploit has been made. At this point in time, it relies upon a hacker reverse-engineering the changes in the latest UpdraftPlus release to work it out. However, you should certainly not rely upon this taking long, but should update immediately. If you are the only user on your WordPress site, or if all your users are trusted, then you are not vulnerable, but we still recommend updating in any case.

Users who are using UpdraftPlus Premium’s feature for encrypting your database backup are protected against data loss/theft from this problem, assuming that you have kept your encryption password secret. (There is no known vulnerability allowing the attacker to also access this). In such cases, only any confidential information in the backup of your files is at risk (and then usually only your media/upload files, since plugins and themes are usually only public code that contains nothing sensitive, being downloadable from their original supplier/author by any member of the public). Note also that the WordPress database, following modern security standards, hashes stored passwords. This means that your WordPress login password is protected even from someone who has obtained even an unencrypted copy of it.

This information is now being released approximately a day after updated, secured versions of UpdraftPlus became available. During that time, the majority of sites have been updated.

Again, we urge all users to update if they have not done so already. We at UpdraftPlus sincerely apologise for any and all inconvenience that has been caused, and wish to thank Marc for working together with us. From the moment we received the report, it was “all hands on deck”. An update was pushed to Premium users within the hour. We have lost a good amount of sleep, because your sites and their backups matter to us, and we will continue working hard to make sure that continues to be the case.

(Addendum: versions 1.22.4 / 2.22.4 have subsequently been released, which deals with a conflict with a bug in a popular third-party plugin, via adding a work-around (we have also reported the issue to the plugin author)).

David Anderson (lead developer)