CVE-2022-0633

The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.

• CWE-863
• CWE-863

• http://packetstormsecurity.com/files/166059/WordPress-UpdraftPlus-1.22.2-Backup-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/Exploit, Third Party Advisory
• https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/Release Notes, Vendor Advisory
• https://wpscan.com/vulnerability/d257c28f-3c7e-422b-a5c2-e618ed3c0bf3Third Party Advisory
• http://packetstormsecurity.com/files/166059/WordPress-UpdraftPlus-1.22.2-Backup-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
• https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/Exploit, Third Party Advisory
• https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/Release Notes, Vendor Advisory
• https://wpscan.com/vulnerability/d257c28f-3c7e-422b-a5c2-e618ed3c0bf3Third Party Advisory

Published

Feb 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-0627The Amelia WordPress plugin before 1.0.47 does not sanitize …6.1
• CVE-2022-0628The Mega Menu WordPress plugin before 3.0.8 does not sanitiz…6.1
• CVE-2022-0629Stack-based Buffer Overflow in GitHub repository vim/vim pri…7.8
• CVE-2022-0630Out-of-bounds Read in Homebrew mruby prior to 3.2.7.1
• CVE-2022-0631Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.9.8
• CVE-2022-0632NULL Pointer Dereference in Homebrew mruby prior to 3.2.5.5
• CVE-2022-0634The ThirstyAffiliates WordPress plugin before 3.10.5 lacks a…4.3
• CVE-2022-0635Versions affected: BIND 9.18.0 When a vulnerable version of …7.5
• CVE-2022-0636A denial of service vulnerability was reported in Lenovo Thi…5.5
• CVE-2022-0637open redirect in pollbot (pollbot.services.mozilla.com) in v…6.1
• CVE-2022-0638Cross-Site Request Forgery (CSRF) in Packagist microweber/mi…4.3
• CVE-2022-0639Authorization Bypass Through User-Controlled Key in NPM url-…5.3