WordPress has taken the rare step of force-updating the UpdraftPlus plugin on all sites to fix a high-severity vulnerability allowing website subscribers to download the latest database backups, which often contain credentials and PII.

Three million sites use the popular WordPress plugin, so the potential for exploitation was substantial, affecting a significant share of the internet, including large platforms.

The vulnerability affects UpdraftPlus versions 1.16.7 to 1.22.2, and the developers fixed it with the release of 1.22.3 or 2.22.3 for the (paid) Premium version.

The flaw was discovered by security researcher Marc Montpas of Automattic and is tracked as CVE-2022-0633 and carries a CVSS v3.1 score of 8.5.

Flaw and exploitation

UpdraftPlus helps simplify the process of backups and restoration with scheduled backup functions and an auto-download option to a trusted email address.

However, due to bugs found in the plugin, any low-level authenticated user can craft a valid link that would allow them to download the files.

The issue is improper user validation on whet