title: UpdraftPlus Free < 1.22.3 & Premium < 2.22.3 - Subscriber+ Backup Download
description: The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
problem types: CWE-863 Incorrect Authorization
affected:
{
product: UpdraftPlus WordPress Backup Plugin (Free)
vendor: UpdraftPlus
versions:
lessThan: 1.22.3, status: affected, version: 1.22.3, versionType: custom
}
{
product: UpdraftPlus WordPress Backup Plugin (Premium)
vendor: UpdraftPlus
versions:
lessThan: 2.22.3, status: affected, version: 2.22.3, versionType: custom
}
