{"id":"CVE-2022-0633","aliases":["EUVD-2022-15730","GHSA-w56x-f43j-rgx4"],"status":"published","title":"UpdraftPlus Free \u003c 1.22.3 \u0026 Premium \u003c 2.22.3 - Subscriber+ Backup Download","description":"The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site \u0026 database backup.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02066,"percentile":0.81516,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2022-02-17T18:45:11Z","modified":"2026-06-17T04:20:58Z","products":[{"vendor":"updraftplus","product":"updraftplus"},{"vendor":"updraftplus","product":"updraftplus wordpress backup plugin (free)"},{"vendor":"updraftplus","product":"updraftplus wordpress backup plugin (premium)"}],"references":[{"url":"https://wpscan.com/vulnerability/d257c28f-3c7e-422b-a5c2-e618ed3c0bf3","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Vendor Advisory"]},{"url":"https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/166059/WordPress-UpdraftPlus-1.22.2-Backup-Disclosure.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0633"},{"url":"https://github.com/advisories/GHSA-w56x-f43j-rgx4"}],"sources":{"cve":[{"id":"CVE-2022-0633","title":"UpdraftPlus Free \u003c 1.22.3 \u0026 Premium \u003c 2.22.3 - Subscriber+ Backup Download","description":"The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site \u0026 database backup.","status":"published","published":"2022-02-17T18:45:11Z","modified":"2024-08-02T23:32:46.437Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-15730","description":"The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site \u0026 database backup.","status":"published","published":"2022-02-17T18:45:11Z","modified":"2024-08-02T23:32:46Z","updated_at":"2026-11-03T03:26:04.481305Z"}],"ghsa":[{"id":"GHSA-w56x-f43j-rgx4","title":"The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly...","description":"The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site \u0026 database backup.","status":"published","published":"2022-02-18T00:00:32Z","modified":"2023-02-03T05:06:19Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:53:52.731364Z"}],"nvd":[{"id":"CVE-2022-0633","description":"The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site \u0026 database backup.","status":"published","published":"2022-02-17T19:15:08.03Z","modified":"2026-06-17T04:20:58.323Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:12.155838Z"}]}}