WordPress News
UpdraftPlus 1.26.10 Released
What’s new in UpdraftPlus 1.26.10
Released: 15/Oct/2026
Active installations: 4,000,000
Tested up to WordPress 7.1.3
Changelog
- SECURITY: Thanks to Jakub Herman for reporting a second/related instance of the problem patched in 1.26.9. In this related instance, the problem could lead to execution only if the site was restored on a database server which differed in configuration from that on which the backup was taken. Nevertheless, all users should update.
Previous releases
1.26.9 — 14/Oct/2026
- SECURITY: On a site where an attacker who is not an admin has the ability to insert a database cell over 1MB with his own chosen content, if the site owner backs up and restores the site, then upon restoring, arbitrary SQL from the attacker may be run. Thanks to Wordfence for the responsible disclosure.
- TWEAK: Drop support for generating RSA keys less than 2048 bits
- TWEAK: If set, unset the SQL compatibility mode NO_BACKSLASH_ESCAPE
1.26.8 — 17/Sep/2026
- SECURITY: On a site which has been migrated (i.e. moved to a new address using UpdraftPlus’s migration feature), and is using an .htaccess file, and the .htaccess file has not been updated with the new site reference, and where the site owner does not respond to the notice to do so, and where the site has non-admin users who can login to the WP dashboard, and where the site had saved storage login credentials in the UpdraftPlus settings, such a logged-in user could access some of those credentials (e.g. could access FTP, but not Dropbox). Thanks to Jakub Herman for notifying us of this issue (via WPScan).
- FEATURE: Implemented an onboarding wizard to assist first-time users with plugin configuration (requires WordPress 6.2+ and PHP 7.4+).
- FIX: Error caused by the FTP wrapper referencing the STDIN constant when configuring the cURL CURLOPT_INFILE option. Since STDIN is only defined under the PHP CLI SAPI, this caused failures in PHP-FPM environments.
- FIX: WebDAV backup failures caused by a deprecated regular expression escape since PCRE2 version 10.45.
- TWEAK: The “Tour” functionality has been removed from the UI and deactivated. Its underlying code remains temporarily and will be fully removed in a future release.