WordPress News
UpdraftPlus 1.26.12 Released
What’s new in UpdraftPlus 1.26.12
Released: 19/Oct/2026
Active installations: 4,000,000
Tested up to WordPress 7.1.3
Changelog
- SECURITY: Revokes UpdraftCentral Cloud keys created before the incident described at https://teamupdraft.com/blog/security-incident-october-2026/
Previous releases
1.26.11 — 16/Oct/2026
- SECURITY: The fix in 1.26.9 did not correctly handle NO_BACKSLASH_ESCAPES (a rare SQL server mode which is no longer supported by WordPress from WordPress 7.2 and causes various problems if set). Though your website almost certainly does not use it, it is still best to update.
- FIX: When an near-over-sized (beyond the maximum packet size) line with a specific (unlikely) construction was rejected, it could be silently dropped in 1.26.10
- TWEAK: Re-factor set_sql_mode() to allow indicating the success of the attempt
- TWEAK: If a backup file is invalid with trailing content which cannot be executed, then log this
1.26.10 — 15/Oct/2026
- SECURITY: Thanks to Jakub Herman for reporting a second/related instance of the problem patched in 1.26.9. In this related instance, the problem could lead to execution only if the site was restored on a database server which differed in configuration from that on which the backup was taken. Nevertheless, all users should update.