Critical SQL Injection in Backuply WordPress Plugin Affects Over 600,000 Sites
A second-order SQL injection vulnerability in the Backuply WordPress plugin allows attackers with subscriber access to gain administrator privileges and take over websites.
A critical Second-Order SQL Injection vulnerability, identified as CVE-2026-93953, has been discovered in the popular Backuply WordPress plugin, potentially impacting over 600,000 websites. The flaw, present in versions up to 1.5.8, allows authenticated attackers with even basic subscriber-level access to inject malicious SQL code.
This vulnerability operates through a two-step process. First, an attacker crafts a malicious payload and inserts it into the 'Biographical Info' field of their user profile. This input is then stored by the plugin. The true danger materializes when an administrator later initiates a database restore operation using a backup that includes this compromised user data. During the restore process, the plugin's handling of the stored biographical information triggers the execution of the injected SQL.
The technical analysis reveals that the vulnerability lies within the plugin's restore functionality. When restoring a database backup, the Backuply plugin processes SQL statements from the dump. A regular expression used to identify the site's table prefix is applied to these statements. However, this expression is not sufficiently anchored and can incorrectly match parts of the user-supplied biographical information, especially when combined with specific strings like 'backuply_version'. This allows an attacker to craft their biographical information to contain a full SQL UPDATE statement, which is then executed by the plugin.
By exploiting this, an attacker can modify critical database options. Specifically, they can alter the default_role option in the wp_options table to 'administrator' and enable open user registration. Consequently, any new user registered on the site after the exploit will automatically be granted administrator privileges, leading to a complete site takeover.
The vulnerability was reported to Wordfence on September 17th, 2026, and the researcher, daroo, was awarded a bounty of $1,352.00 through the Wordfence Bug Bounty Program. Wordfence began providing protection for its Premium, Care, and Response users via a firewall rule on September 24, 2026. The Backuply development team was notified on September 28, 2026, and responded promptly by releasing a patched version, 1.5.9, on October 1, 2026.
Wordfence urges all users of the Backuply plugin to update to version 1.5.9 immediately to mitigate the risk of privilege escalation and full site compromise. The vulnerability carries a CVSS rating of 8.0, classifying it as High severity. The free version of Wordfence will provide protection to its users 30 days after the initial disclosure, on October 24, 2026.
This incident highlights the persistent threat posed by SQL injection vulnerabilities, particularly those that are second-order, as they can be harder to detect and exploit. The ease with which an attacker can gain administrator access underscores the importance of diligent input validation and secure coding practices in all WordPress plugins, especially those handling sensitive data and restore operations.