UpdraftPlus <= 1.26.8 - Unauthenticated SQL Injection via Database Restore
- ID
- WPSEC-2026-1035
- Plugin
- UpdraftPlus: WP Backup & Migration Plugin (updraftplus)
- Affected
- all versions before 1.26.9
- Remediation
- Update to 1.26.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- UpdraftPlus on WPSec AttackSurface
- Fix released
- Published
Description
The UpdraftPlus plugin for WordPress is vulnerable to SQL Injection via the database restore process in all versions up to, and including, 1.26.8. The cause is insufficient parsing of backed-up SQL when splitting it into statements: a line was treated as a complete statement when it simply ended in a closing parenthesis and delimiter, without checking that quotes and brackets were balanced. This makes it possible for unauthenticated attackers who can store a large (over 1MB) database value with crafted content, for example through a site feature that accepts visitor-submitted data, to have arbitrary SQL queries executed when a site administrator later backs up and restores the site. This could lead to full site compromise, such as the creation of administrator accounts.
References
- https://wpsec.com/vuln/WPSEC-2026-1035/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.9/
- https://wordpress.org/plugins/updraftplus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS