# UpdraftPlus <= 1.26.10 - Unauthenticated SQL Injection via Database Restore

- **ID:** WPSEC-2026-1205
- **Plugin:** UpdraftPlus: WP Backup & Migration Plugin (`updraftplus`), https://wordpress.org/plugins/updraftplus/
- **Affected versions:** all versions before 1.26.11
- **Fixed in:** 1.26.11 (Update to 1.26.11 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-89
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/updraftplus
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1205/

## Description

The UpdraftPlus plugin for WordPress is vulnerable to SQL Injection via the database restore process in all versions up to, and including, 1.26.10. This is due to the restorer not clearing the NO_BACKSLASH_ESCAPES SQL mode before running the backed-up SQL (the mode was missing from the list of modes to clear, and from 1.26.9 it was listed under the misspelled name 'NO_BACKSLASH_ESCAPE') and continuing the restore without checking that the SQL mode had changed. Database backups always escape quotes and backslashes in values with backslashes, so on a database server running in this mode the server reads attacker-supplied text inside a quoted value as SQL. This makes it possible for unauthenticated attackers who can store content in the site's database (for example comments or form submissions) to inject SQL into the queries run when an administrator restores a backup. Exploitation requires the non-default NO_BACKSLASH_ESCAPES server mode and an administrator performing a restore.

## References

- https://wpsec.com/vuln/WPSEC-2026-1205/
- https://plugins.svn.wordpress.org/updraftplus/tags/1.26.11/
- https://wordpress.org/plugins/updraftplus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1205/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.