A recent security flaw was discovered in updraft and user should update immediately.
https://www.theregister.com/2022/02/...rief_security/

Overall the hole would most likely only be exploitable for those that possibly have others that log in to their wordpress sites, such as those that use outside writers etc.

If such a site has updraft active, non admin users could download an existing backup, even if they did not have admin rights.

So far, this seems to only be exploitable by those who have approved log in accounts. I imagine this also means those with logon rights for comments, if you have it set that commenters need login accounts to leave a comment.

Overall the flaw does not sound hugely critical, but best to update anyway as who knows if there could be other things done with that kind of escalation.

As a side note, if this kind of flaw sounds completely scary, is it that you do not trust those you allow to log in to your backend? If not, why do they have access in the first place?

Rick
Universal4