CVE-2026-66708 BoldGrid CVE debrief

Who should care

Users of Total Upkeep plugin version 1.17.2 or earlier should patch to version 1.17.3 or later and verify access controls are properly configured. This includes administrators and security teams responsible for maintaining and securing WordPress installations with the Total Upkeep plugin. Additionally, operators and platform managers should review the vulnerability's impact on their environments and take appropriate actions to mitigate potential risks. Vulnerability management teams should prioritize patching and verify access controls for Total Upkeep plugin version 1.17.2 or earlier. Security teams should monitor for suspicious activity and review compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory managers should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those responsible for change management should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those responsible for incident response should check relevant monitoring, detection, and logs for exposed assets that need extra review. Those responsible for source tracking should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring should be implemented to detect potential exploitation attempts. Asset inventory should be updated to reflect the presence of affected systems. Rollback/change windows should be considered for patching. Source tracking should be implemented to monitor for updates from the vendor. The CVE record was published on 2026-08-06T15:17:23.793Z and has not been modified since then. The vulnerability is an unauthenticated broken access control vulnerability in Total Upkeep plugin versions up to 1.17.2. The CVE record provides official details, and the NVD provides additional information on the vulnerability. Mitigation or vendor references are also available for further guidance. The source item URL provides additional context. Further verification is

Technical summary

CVE-2026-66708 is an unauthenticated broken access control vulnerability in Total Upkeep plugin versions up to 1.17.2. The vulnerability has a CVSS score of 8.2 and is classified as HIGH severity. The vulnerability allows an attacker to bypass access controls and potentially gain unauthorized access to sensitive data or functionality. The affected plugin is widely used for backup and maintenance tasks in WordPress environments. Users of Total Upkeep plugin version 1.17.2 or earlier should patch to version 1.17.3 or later and verify access controls are properly configured. The CVE record provides official details, and the NVD provides additional information on the vulnerability. Mitigation or vendor references are also available for further guidance.

Defensive priority

Patch and verify access controls for Total Upkeep plugin version 1.17.2 or earlier.

Recommended defensive actions

• Patch Total Upkeep plugin to version 1.17.3 or later
• Verify access controls are properly configured
• Monitor for suspicious activity

Evidence notes

Evidence from Patchstack and NVD indicates a vulnerability in Total Upkeep plugin versions up to 1.17.2. Further verification needed. The vulnerability has a CVSS score of 8.2 and is classified as HIGH severity. Users of Total Upkeep plugin version 1.17.2 or earlier should patch to version 1.17.3 or later and verify access controls are properly configured.

Official resources