UpdraftPlus Backup Premium 2.26.13.26

* FIX: Properly apply the revocation in 1.26.12

IMPROVED

• Re-factor set_sql_mode() to allow indicating the success of the attempt
• If a backup file is invalid with trailing content which cannot be executed, then log this

FIXED

• When an near-over-sized (beyond the maximum packet size) line with a specific (unlikely) construction was rejected, it could be silently dropped in 1.26.10

SECURITY

• The fix in 1.26.9 did not correctly handle NO_BACKSLASH_ESCAPES (a rare SQL server mode which is no longer supported by WordPress from WordPress 7.2 and causes various problems if set). Though your website almost certainly does not use it, it is still best to update.

IMPROVED
Drop support for generating RSA keys less than 2048 bits
If set, unset the SQL compatibility mode NO_BACKSLASH_ESCAPE

SECURITY
On a site where an attacker who is not an admin has the ability to insert a database cell over 1MB with his own chosen content, if the site owner backs up and restores the site, then upon restoring, arbitrary SQL from the attacker may be run. Thanks to Wordfence for the responsible disclosure.

* SECURITY: Restoration now requires provision of a nonce, and not only the epoch-second timestamp of a backup. This prevents an insider threat in which a previous administrator who has been removed from a site could seek to persuade a logged-in current administrator to follow a link to restore a backup which he had previous knowledge of. Thanks to Jashid Sany for raising this issue (via WPScan).
* TWEAK: In UpdraftPlus Premium, for scheduled monthly backups, change the behaviour to backup on the chosen day every month (better matching user expectation).
* TWEAK: UpdraftClone no longer supports clones launched with PHP 5.4 or 5.5.

* FEATURE: Upon plugin deactivation, a popup will appear with data removal options, enabling users to opt-in to deleting saved data.
* FIX: "Unattached" media filter lists attached images when no unattached items exist
* TWEAK: Added Burst Statistics to TeamUpdraft family admin notices.
* TWEAK: Create a better UX for free users around premium remote storage locations
* TWEAK: Prefer http_get_last_response_headers() (PHP 8.4+) to avoid PHP 8.5 deprecation warnings for $http_response_header.
* TWEAK: Replace the calls to the native PHP 'unserialize()' function in the Google Drive and HTTP_Request2 libraries.

* SECURITY: Previous versions contained a defect allowing sites with an active Migrator key (paid versions only) or UpdraftCentral key (free and paid versions) to have unauthorised operations carried out on them. All users should update immediately.
* TWEAK: Added explicit HTTP timeout of 60 seconds to pCloud chunk upload requests to prevent cURL error 28 on slow server connections
* TWEAK: Guard curl_close(), finfo_close() and xml_parser_free() calls with a PHP version check to prevent deprecation warnings on PHP 8.5+
* TWEAK: Update the bundled common-libs version
* TWEAK: Replace all usages of wpdb::esc_like() with UpdraftPlus_Database_Utility::esc_like() across the codebase to maintain consistency.
* TWEAK: Add "auto-backup before update" tour guide

* FIX: In version 1.26.2, a regression prevented the backup schedule, including the day name or number, as well as backup entity exclusion rules, from being saved.
* TWEAK: Alert users who wrongly enter URLs instead of an actual hostname for SFTP and FTP remote storage.
* TWEAK: Updated DreamObjects endpoints by removing the deprecated objects-us-west-1, marking objects-us-east-1.dream.io as unavailable (Nov. 12th, 2025), and adding admin notices to inform users of this change.
* TWEAK: get_structured_data() now accepts params to avoid timeouts.

Fix: Google Drive chunked uploads didn’t resume from where it left off but started from the beginning, resulting in file duplicates.
Tweak: Add a WP-CLI command to register a product key (premium).
Tweak: Add product registration link on the premium version.
Tweak: Fix JS error on UpdraftCentral Cloud connect modal.
Tweak: Fix grammatical error in the low disk space admin notice.
Tweak: Update links for better user experience.
Tweak: Update the premium links on the settings page.
Tweak: Update all links in the includes/notices/central folders to use teamupdraft.com instead of updraftplus.com.
Tweak: Upgrade the common-libs tag version.

2.25.9.26

* FIX: A regression that resulted in the list of tables within the "Database size" tools not being displayed, due to code refactoring implemented in version 1.25.8.
* TWEAK: Add function for returning Advanced Tools menu data in a structured format.
* TWEAK: Resolve regression in 1.25.2 which caused the admin notice "Not yet connected to licence" was linking to teamupdraft.com instead of the UpdraftPlus Premium/Extensions tab.
* TWEAK: Refactoring connection keys data function to deduplicate and read from a single source
* TWEAK: Restored the missing backup confirmation pop-up icon for older WordPress versions.
* TWEAK: Stripped unwanted HTML from the plain-text notice and added new lines after each sentences in the sale offer message.
* TWEAK: Update Black Friday seasonal sale URL/link
* TWEAK: Updated "Check our premium" and "Back up non-WP tables and external databases" URL links to avoid HTTP 404 (not found) errors.
* TWEAK: Update database charset detection to support both CHARSET= and CHARACTER SET syntax in SQL dumps
* TWEAK: Replaced deprecated (boolean) casting