Outage in Nexcess
Security Advisory: Update Avada Builder and UpdraftPlus WordPress Plugins Immediately
Resolved MinorIncident Report
Summary AI Generated
Nexcess issued a security advisory warning WordPress customers of two critical vulnerabilities affecting Avada Builder (versions 3.15.2 and earlier) and UpdraftPlus (versions 1.26.4 and earlier), impacting regions us-midwest-1, us-west-1, and uk-south-2. The flaws could allow unauthenticated attackers to execute remote code or bypass authentication, potentially compromising WordPress sites and user accounts. The advisory remained active for approximately 13 days before being closed, with customers directed to update the affected plugins immediately and review their installations for signs of compromise.
We are advising all customers using WordPress to verify that the following plugins are updated to the latest available versions.
Recently disclosed vulnerabilities affect older versions of these plugins:
CVE-2026-6279 – Avada Builder (Fusion Builder) – Unauthenticated Remote Code Execution
Affected versions: 3.15.2 and earlier
CVE-2026-10795 – UpdraftPlus Backup Plugin – Authentication Bypass
Affected versions: 1.26.4 and earlier
These vulnerabilities may allow unauthenticated attackers to gain control of vulnerable WordPress sites and compromise WordPress user accounts if the plugins have not been updated to the latest available versions.
If your website uses either of these plugins, we strongly recommend that you:
Update the affected plugin(s) to the latest available version immediately.
Review your WordPress installation for any unexpected administrator accounts, plugins, or modified files.
Contact our Support team if you believe your website has been affected or if you need assistance reviewing your installation.
Trusted by 1,000+ teams
The Status Page Aggregator with Early Outage Detection
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
RESOLVED
24 days ago - at 07/09/2026 02:16PM
This advisory is now being closed.
We encourage our customers to ensure that any affected WordPress plugins have been updated to the latest available versions and continue following WordPress security best practices.
If you believe your website may have been impacted or require assistance, please contact our Support team.
INVESTIGATING
about 1 month ago - at 06/26/2026 05:27AM
We are advising all customers using WordPress to verify that the following plugins are updated to the latest available versions.
Recently disclosed vulnerabilities affect older versions of these plugins:
CVE-2026-6279 – Avada Builder (Fusion Builder) – Unauthenticated Remote Code Execution
Affected versions: 3.15.2 and earlier
CVE-2026-10795 – UpdraftPlus Backup Plugin – Authentication Bypass
Affected versions: 1.26.4 and earlier
These vulnerabilities may allow unauthenticated attackers to gain control of vulnerable WordPress sites and compromise WordPress user accounts if the plugins have not been updated to the latest available versions.
If your website uses either of these plugins, we strongly recommend that you:
Update the affected plugin(s) to the latest available version immediately.
Review your WordPress installation for any unexpected administrator accounts, plugins, or modified files.
Contact our Support team if you believe your website has been affected or if you need assistance reviewing your installation.
Latest Nexcess outages
WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030 - 15 days ago
Service Interruption on Cloudhost | 76771 - 23 days ago
Januscape Vulnerability (CVE-2026-53359) - 24 days ago
The Status Page Aggregator with Early Outage Detection
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
