# UpdraftPlus <= 1.26.8 - Unauthenticated SQL Injection via Database Restore

- **ID:** WPSEC-2026-1035
- **Plugin:** UpdraftPlus: WP Backup & Migration Plugin (`updraftplus`), https://wordpress.org/plugins/updraftplus/
- **Affected versions:** all versions before 1.26.9
- **Fixed in:** 1.26.9 (Update to 1.26.9 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/updraftplus
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1035/

## Description

The UpdraftPlus plugin for WordPress is vulnerable to SQL Injection via the database restore process in all versions up to, and including, 1.26.8. The cause is insufficient parsing of backed-up SQL when splitting it into statements: a line was treated as a complete statement when it simply ended in a closing parenthesis and delimiter, without checking that quotes and brackets were balanced. This makes it possible for unauthenticated attackers who can store a large (over 1MB) database value with crafted content, for example through a site feature that accepts visitor-submitted data, to have arbitrary SQL queries executed when a site administrator later backs up and restores the site. This could lead to full site compromise, such as the creation of administrator accounts.

## References

- https://wpsec.com/vuln/WPSEC-2026-1035/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.9/
- https://wordpress.org/plugins/updraftplus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1035/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.