Cross-Site Request Forgery Vulnerability in UpdraftPlus Backup Plugin for WordPress

CVE-2023-5982

Summary

The UpdraftPlus Backup & Migration plugin for WordPress is affected by a Cross-Site Request Forgery vulnerability due to inadequate nonce validation and insufficient verification of the instance_id in the 'updraftmethod-googledrive-auth' action. An unauthenticated attacker can trick a site administrator into clicking a malicious link, enabling them to alter the Google Drive backup destination. This could lead to the attacker receiving backups that may contain sensitive site information, putting the site's security at significant risk.

References