CVE-2023-5982

The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on the 'updraftmethod-googledrive-auth' action used to update Google Drive remote storage location. This makes it possible for unauthenticated attackers to modify the Google Drive location that backups are sent to via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can make it possible for attackers to receive backups for a site which may contain sensitive information.

• CWE-352
• CWE-352

• https://plugins.trac.wordpress.org/changeset/2989669/updraftplus/tags/1.23.11/class-updraftplus.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e1be11c5-0a44-4816-b6bf-d330cb51dbf3?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/2989669/updraftplus/tags/1.23.11/class-updraftplus.phpPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e1be11c5-0a44-4816-b6bf-d330cb51dbf3?source=cveThird Party Advisory

Published

Nov 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-5976Improper Access Control in GitHub repository microweber/micr…4.3
• CVE-2023-5977Rejected reason: Accidental Request.
• CVE-2023-5978In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, unde…7.5
• CVE-2023-5979The eCommerce Product Catalog Plugin for WordPress plugin be…6.5
• CVE-2023-5980The BSK Forms Blacklist WordPress plugin before 3.7 does not…4.8
• CVE-2023-5981A vulnerability was found that the response times to malform…5.9
• CVE-2023-5983Exposure of Private Personal Information to an Unauthorized …7.5
• CVE-2023-5984 A CWE-494 Download of Code Without Integrity Check vulnerab…4.9
• CVE-2023-5985 A CWE-79 Improper Neutralization of Input During Web Page…4.8
• CVE-2023-5986 A CWE-601 URL Redirection to Untrusted Site vulnerability e…6.1
• CVE-2023-5987 A CWE-79 Improper Neutralization of Input During Web Page G…6.1
• CVE-2023-5988Improper Neutralization of Input During Web Page Generation …6.1