CVE-2026-3143

MEDIUM

Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-3143. PoCs published by ClimbMunchkin.

AI-analyzed exploit summary This repository provides a diagnostic and mitigation script for CVE-2026-31431, focusing on detecting and patching a vulnerability in the Linux kernel's AF_ALG AEAD module. It includes checks for kernel configuration, module status, and vulnerability exposure but does not contain exploit code.

Description

The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update.

Exploits (1)

nomisec SCANNER
by ClimbMunchkin · poc
https://github.com/ClimbMunchkin/fix-cve-2026-3143

This repository provides a diagnostic and mitigation script for CVE-2026-31431, focusing on detecting and patching a vulnerability in the Linux kernel's AF_ALG AEAD module. It includes checks for kernel configuration, module status, and vulnerability exposure but does not contain exploit code.

Classification
Scanner 90%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Linux kernel (specific versions not explicitly detailed)
Auth required
Prerequisites: root access · Linux system with vulnerable kernel
devstral-2 · analyzed May 08, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 5.3
EPSS 0.0026
EPSS Percentile 16.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
boldgrid/Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid < 1.17.1
Published May 01, 2026
Tracked Since May 01, 2026