# UpdraftPlus <= 1.26.9 - Unauthenticated SQL Injection via Database Restore

- **ID:** WPSEC-2026-1109
- **Plugin:** UpdraftPlus: WP Backup & Migration Plugin (`updraftplus`), https://wordpress.org/plugins/updraftplus/
- **Affected versions:** all versions before 1.26.10
- **Fixed in:** 1.26.10 (Update to 1.26.10 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/updraftplus
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1109/

## Description

The UpdraftPlus plugin for WordPress is vulnerable to SQL Injection via the database restore process in all versions up to, and including, 1.26.9. This is due to the restorer splitting long multi-row INSERT statements to fit the database server's max_allowed_packet without first checking that the statement built so far is complete, for example that a quoted string value is not still open. The part of a backed-up value after the split point is then parsed as SQL. This makes it possible for unauthenticated attackers who can store a very large value in the site's database to have arbitrary SQL run when an administrator restores a database backup onto a server whose max_allowed_packet is smaller than the backup needs. This is a related instance of the issue patched in 1.26.9.

## References

- https://wpsec.com/vuln/WPSEC-2026-1109/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.10/
- https://wordpress.org/plugins/updraftplus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1109/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.