WordPress News

UpdraftPlus 1.26.9 Released

high confidence based on 1 community posts

What’s new in UpdraftPlus 1.26.9

Released: 14/Oct/2026

Active installations: 4,000,000

Tested up to WordPress 7.1.3

SECURITY: On a site where an attacker who is not an admin has the ability to insert a database cell over 1MB with his own chosen content, if the site owner backs up and restores the site, then upon restoring, arbitrary SQL from the attacker may be run. Thanks to Wordfence for the responsible disclosure.
TWEAK: Drop support for generating RSA keys less than 2048 bits
TWEAK: If set, unset the SQL compatibility mode NO_BACKSLASH_ESCAPE

1.26.8 — 17/Sep/2026

SECURITY: On a site which has been migrated (i.e. moved to a new address using UpdraftPlus’s migration feature), and is using an .htaccess file, and the .htaccess file has not been updated with the new site reference, and where the site owner does not respond to the notice to do so, and where the site has non-admin users who can login to the WP dashboard, and where the site had saved storage login credentials in the UpdraftPlus settings, such a logged-in user could access some of those credentials (e.g. could access FTP, but not Dropbox). Thanks to Jakub Herman for notifying us of this issue (via WPScan).
FEATURE: Implemented an onboarding wizard to assist first-time users with plugin configuration (requires WordPress 6.2+ and PHP 7.4+).
FIX: Error caused by the FTP wrapper referencing the STDIN constant when configuring the cURL CURLOPT_INFILE option. Since STDIN is only defined under the PHP CLI SAPI, this caused failures in PHP-FPM environments.
FIX: WebDAV backup failures caused by a deprecated regular expression escape since PCRE2 version 10.45.
TWEAK: The “Tour” functionality has been removed from the UI and deactivated. Its underlying code remains temporarily and will be fully removed in a future release.

1.26.7 — 21/Aug/2026

SECURITY: Restoration now requires provision of a nonce, and not only the epoch-second timestamp of a backup. This prevents an insider threat in which a previous administrator who has been removed from a site could seek to persuade a logged-in current administrator to follow a link to restore a backup which he had previous knowledge of. Thanks to Jashid Sany for raising this issue (via WPScan).
TWEAK: In UpdraftPlus Premium, for scheduled monthly backups, change the behaviour to backup on the chosen day every month (better matching user expectation).
TWEAK: UpdraftClone no longer supports clones launched with PHP 5.4 or 5.5.