Outage in Liquid Web
Security Advisory: Update Avada Builder and UpdraftPlus WordPress Plugins Immediately
Resolved MinorIncident Report
Summary AI Generated
Liquid Web issued a security advisory warning WordPress customers of two critical vulnerabilities: an unauthenticated remote code execution flaw in Avada Builder (versions 3.15.2 and earlier) and an authentication bypass in UpdraftPlus (versions 1.26.4 and earlier), both capable of allowing attackers to take control of affected sites. The advisory remained active for approximately 13 days while customers were urged to update the affected plugins and audit their WordPress installations for signs of compromise. The incident was resolved on July 9, 2026, with Liquid Web continuing to recommend plugin updates and adherence to WordPress security best practices.
We are advising all customers using WordPress to verify that the following plugins are updated to the latest available versions.
Recently disclosed vulnerabilities affect older versions of these plugins:
CVE-2026-6279 – Avada Builder (Fusion Builder) – Unauthenticated Remote Code Execution
Affected versions: 3.15.2 and earlier
CVE-2026-10795 – UpdraftPlus Backup Plugin – Authentication Bypass
Affected versions: 1.26.4 and earlier
These vulnerabilities may allow unauthenticated attackers to gain control of vulnerable WordPress sites and compromise WordPress user accounts if the plugins have not been updated to the latest available versions.
If your website uses either of these plugins, we strongly recommend that you:
Update the affected plugin(s) to the latest available version immediately.
Review your WordPress installation for any unexpected administrator accounts, plugins, or modified files.
Contact our Support team if you believe your website has been affected or if you need assistance reviewing your installation.
Trusted by 1,000+ teams
The Status Page Aggregator with Early Outage Detection
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
RESOLVED
9 days ago - at 07/09/2026 02:15PM
This advisory is now being closed.
We encourage our customers to ensure that any affected WordPress plugins have been updated to the latest available versions and continue following WordPress security best practices.
If you believe your website may have been impacted or require assistance, please contact our Support team.
INVESTIGATING
22 days ago - at 06/26/2026 05:23AM
We are advising all customers using WordPress to verify that the following plugins are updated to the latest available versions.
Recently disclosed vulnerabilities affect older versions of these plugins:
CVE-2026-6279 – Avada Builder (Fusion Builder) – Unauthenticated Remote Code Execution
Affected versions: 3.15.2 and earlier
CVE-2026-10795 – UpdraftPlus Backup Plugin – Authentication Bypass
Affected versions: 1.26.4 and earlier
These vulnerabilities may allow unauthenticated attackers to gain control of vulnerable WordPress sites and compromise WordPress user accounts if the plugins have not been updated to the latest available versions.
If your website uses either of these plugins, we strongly recommend that you:
Update the affected plugin(s) to the latest available version immediately.
Review your WordPress installation for any unexpected administrator accounts, plugins, or modified files.
Contact our Support team if you believe your website has been affected or if you need assistance reviewing your installation.
Latest Liquid Web outages
WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030 - about 12 hours ago
Power Outage in Phoenix, AZ - 1 day ago
Januscape Vulnerability (CVE-2026-53359) - 9 days ago
WHM login failures - 10 days ago
The Status Page Aggregator with Early Outage Detection
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
