UpdraftPlus <= 1.26.10 - Unauthenticated SQL Injection via Database Restore
- ID
- WPSEC-2026-1205
- Plugin
- UpdraftPlus: WP Backup & Migration Plugin (updraftplus)
- Affected
- all versions before 1.26.11
- Remediation
- Update to 1.26.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness
- CWE-89
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-17
- Attack surface
- UpdraftPlus on WPSec AttackSurface
- Fix released
- Published
Description
The UpdraftPlus plugin for WordPress is vulnerable to SQL Injection via the database restore process in all versions up to, and including, 1.26.10. This is due to the restorer not clearing the NO_BACKSLASH_ESCAPES SQL mode before running the backed-up SQL (the mode was missing from the list of modes to clear, and from 1.26.9 it was listed under the misspelled name 'NO_BACKSLASH_ESCAPE') and continuing the restore without checking that the SQL mode had changed. Database backups always escape quotes and backslashes in values with backslashes, so on a database server running in this mode the server reads attacker-supplied text inside a quoted value as SQL. This makes it possible for unauthenticated attackers who can store content in the site's database (for example comments or form submissions) to inject SQL into the queries run when an administrator restores a backup. Exploitation requires the non-default NO_BACKSLASH_ESCAPES server mode and an administrator performing a restore.
References
- https://wpsec.com/vuln/WPSEC-2026-1205/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.11/
- https://wordpress.org/plugins/updraftplus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS