CVE-2026-16253: Unknown Total Upkeep

High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days.

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.

Affected products

• Unknown Total Upkeep: before 1.17.3 (fixed in 1.17.3)

Published 2026-08-12. Last modified 2026-09-03.