What Happened
SiteGround said on June 12 that it had force-updated affected UpdraftPlus installations on its WordPress hosting to version 1.26.5 on June 11. The company reported more than 128,000 affected sites and said its rollout took about 52 minutes. TeamUpdraft separately identifies a security defect fixed in free version 1.26.5 and premium version 2.26.5.
Why It Matters
Backup plugins often have broad access to site files and databases. A prompt security update can reduce exposure, but a backup schedule and a tested restore remain separate safeguards. Site owners using UpdraftPlus should check their installed version and whether their backup schedule still runs as intended.
What the Company Says
SiteGround says it tested upgrade paths and did not expect breakage. TeamUpdraft describes the affected conditions more narrowly than a blanket claim about every installation: the flaw involved an active Migrator key or UpdraftCentral key. Its notice advises affected users to update.
HRL Context
A provider’s response to a serious plugin issue is worth examining alongside backup retention, restore access and customer communication. We would not turn a single rollout into a general security score without repeatable evidence.
What We Haven't Independently Verified
We have not audited SiteGround’s fleet, independently confirmed its site count or rollout duration, or checked whether every affected customer’s backups succeeded afterward. The vulnerability and patched release are supported by the plugin maker’s notice and public advisory record.
Sources & Related Coverage
Original sources
- SiteGround incident response, June 12, 2026 ↗https://www.siteground.com/blog/critical-updraftplus-vulnerability-patched
- TeamUpdraft security update and patched releases ↗https://teamupdraft.com/blog/important-security-update-for-updraftplus-and-updraftcentral-users/
- TeamUpdraft 1.26.5 changelog and key conditions ↗https://teamupdraft.com/updraftplus/changelog/
- NVD vulnerability record CVE-2026-10795 ↗https://nvd.nist.gov/vuln/detail/CVE-2026-10795