WordPress News
UpdraftPlus 1.26.11 Released
What’s new in UpdraftPlus 1.26.11
Released: 16/Oct/2026
Active installations: 4,000,000
Tested up to WordPress 7.1.3
Changelog
- SECURITY: The fix in 1.26.9 did not correctly handle NO_BACKSLASH_ESCAPES (a rare SQL server mode which is no longer supported by WordPress from WordPress 7.2 and causes various problems if set). Though your website almost certainly does not use it, it is still best to update.
- FIX: When an near-over-sized (beyond the maximum packet size) line with a specific (unlikely) construction was rejected, it could be silently dropped in 1.26.10
- TWEAK: Re-factor set_sql_mode() to allow indicating the success of the attempt
- TWEAK: If a backup file is invalid with trailing content which cannot be executed, then log this
Previous releases
1.26.10 — 15/Oct/2026
- SECURITY: Thanks to Jakub Herman for reporting a second/related instance of the problem patched in 1.26.9. In this related instance, the problem could lead to execution only if the site was restored on a database server which differed in configuration from that on which the backup was taken. Nevertheless, all users should update.
1.26.9 — 14/Oct/2026
- SECURITY: On a site where an attacker who is not an admin has the ability to insert a database cell over 1MB with his own chosen content, if the site owner backs up and restores the site, then upon restoring, arbitrary SQL from the attacker may be run. Thanks to Wordfence for the responsible disclosure.
- TWEAK: Drop support for generating RSA keys less than 2048 bits
- TWEAK: If set, unset the SQL compatibility mode NO_BACKSLASH_ESCAPE