UpdraftPlus <= 1.26.9 - Unauthenticated SQL Injection via Database Restore
- ID
- WPSEC-2026-1109
- Plugin
- UpdraftPlus: WP Backup & Migration Plugin (updraftplus)
- Affected
- all versions before 1.26.10
- Remediation
- Update to 1.26.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- UpdraftPlus on WPSec AttackSurface
- Fix released
- Published
Description
The UpdraftPlus plugin for WordPress is vulnerable to SQL Injection via the database restore process in all versions up to, and including, 1.26.9. This is due to the restorer splitting long multi-row INSERT statements to fit the database server's max_allowed_packet without first checking that the statement built so far is complete, for example that a quoted string value is not still open. The part of a backed-up value after the split point is then parsed as SQL. This makes it possible for unauthenticated attackers who can store a very large value in the site's database to have arbitrary SQL run when an administrator restores a database backup onto a server whose max_allowed_packet is smaller than the backup needs. This is a related instance of the issue patched in 1.26.9.
References
- https://wpsec.com/vuln/WPSEC-2026-1109/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.10/
- https://wordpress.org/plugins/updraftplus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS