CVE-2026-3143: 
WordPress vulnerability analysis and mitigation

CVE-2026-3143 is a Missing Authorization vulnerability in the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress. Due to a missing capability check on the wp_ajax_cli_cancel AJAX function, unauthenticated attackers can cancel a pending rollback operation, potentially leaving a WordPress site in a broken state after a failed update. All plugin versions up to and including 1.17.1 are affected. It was published on May 1, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, EUVD).

The root cause is classified as CWE-862 (Missing Authorization). The wp_ajax_cli_cancel function, registered as a WordPress AJAX action, does not perform any capability or nonce check before executing, meaning it is accessible to unauthenticated users via a standard HTTP POST request to wp-admin/admin-ajax.php. An attacker can trigger this endpoint to cancel an in-progress or pending auto-rollback that BoldGrid Total Upkeep initiates when a WordPress update fails. Relevant source code is visible in the plugin's repository at admin/class-boldgrid-backup-admin-auto-rollback.php (line 1202) and admin/class-boldgrid-backup-admin-core.php (line 864) (WordPress Trac, WordPress Trac).

Successful exploitation allows an unauthenticated remote attacker to interfere with the site's automated recovery mechanism by cancelling a pending rollback. This means that if a WordPress core or plugin update fails and triggers an auto-rollback, an attacker can prevent the site from reverting to its last known-good state, potentially leaving the WordPress installation in a broken or partially updated condition. The impact is limited to integrity (low), with no direct confidentiality or availability impact, but the indirect consequence could be prolonged site downtime or instability if administrators are unaware the rollback was cancelled (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and no user interaction, making it trivially easy to attempt, but the limited impact reduces attacker motivation (Wordfence, EUVD).

1. Reconnaissance: Identify WordPress sites running the Total Upkeep – BoldGrid Backup plugin (versions ≤ 1.17.1) using tools like WPScan or by checking publicly accessible plugin metadata at wp-content/plugins/boldgrid-backup/readme.txt.
2. Trigger or wait for a rollback: Either observe or induce a failed WordPress update that causes the plugin to schedule an auto-rollback (this may require prior knowledge of the target's update schedule or triggering a failed update through other means).
3. Send cancellation request: Issue an unauthenticated HTTP POST request to the target site's AJAX endpoint:

   POST /wp-admin/admin-ajax.php
   Content-Type: application/x-www-form-urlencoded
   
   action=cli_cancel

4. Result: The pending rollback is cancelled without any authorization check, leaving the WordPress installation in its post-failed-update state rather than reverting to the previous working version (WordPress Trac, Wordfence).

• Network: Unexpected or repeated HTTP POST requests to /wp-admin/admin-ajax.php with the parameter action=cli_cancel from unauthenticated (not logged-in) IP addresses.
• Logs: WordPress access logs showing POST /wp-admin/admin-ajax.php with action=cli_cancel from external IPs, particularly during or shortly after a WordPress update event.
• Application Behavior: A WordPress site that remains in a broken/partially updated state after a failed update, with no corresponding rollback completion logged by the Total Upkeep plugin, may indicate the rollback was externally cancelled.

Update the Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin to a version above 1.17.1, which includes the fix adding a proper capability check to the wp_ajax_cli_cancel function (see changeset 3480378). The patch was committed to the WordPress plugin repository and is available via the standard WordPress plugin update mechanism. As a temporary workaround, site administrators can disable the plugin until an update is applied, or restrict access to wp-admin/admin-ajax.php via firewall rules for unauthenticated requests (WordPress Trac, Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for the period of April 27 – May 3, 2026, noting it as a medium-severity issue (Wordfence Blog). Community discussion has been minimal, consistent with the vulnerability's limited impact scope. A GitHub Gist was published shortly after disclosure, and a Reddit post referenced the issue in the context of backup plugin reliability (Reddit).