A high-severity SQL injection flaw in the Backuply WordPress plugin could let authenticated attackers with subscriber-level access turn a routine backup restore into a full site takeover. Wordfence says the issue affects versions up to and including 1.5.8, with a patch released in version 1.5.9, and estimates that more than 600,000 active installations may have been exposed.
What Wordfence found in Backuply
Wordfence says it received a submission on September 17, 2026, describing a second-order SQL injection vulnerability in Backuply, a plugin used for backup, restore, migration, and cloning tasks on WordPress sites. The flaw was assigned CVE-2026-93953 and rated 8.0 on the CVSS scale, which places it in the high-severity range.
The issue is not a simple one-step injection. Instead, malicious input is stored first and only becomes dangerous later, when an administrator restores a database backup created after the attacker has planted the payload. That delayed execution is what makes the vulnerability “second-order.”
According to Wordfence, the vulnerable path involves the Biographical Info field in user profiles. Any logged-in user can normally set that field on their own account, and Backuply exports the stored content into the SQL dump used for backups.
How the injection can lead to privilege escalation
The core risk is that Backuply’s restore process can interpret attacker-controlled content in a way that turns data into executable SQL. Wordfence says the plugin exports the biography field verbatim inside an INSERT statement in the backup file, and then later processes that statement during restore in a way that can be manipulated.
In the scenario described by Wordfence, an authenticated attacker with subscriber-level access and above can store a malicious SQL payload in their biography. If an administrator later restores a backup containing that payload, the attacker’s input can break out of the intended SQL context and append attacker-controlled SQL.
Wordfence says the result can be used to modify database records, including the default_role setting in wp_options and the users_can_register option. By enabling public registration and setting the default role to administrator, an attacker can register a new account that is automatically assigned administrator privileges.
That means the exploit does not need to steal data directly to be dangerous. Instead, it can write values into the database in a way that opens the door to complete site compromise.
Why the restore step matters
The vulnerability only triggers when a backup is restored, which is an important limitation and also part of what makes the issue subtle. Wordfence notes that the malicious SQL does not execute at the moment the biography is saved. It executes later, when an administrator restores a database backup that contains the planted content.
That makes the restore process the critical moment. Because creating and restoring backups is the entire purpose of the plugin, the vulnerable code path is tied to a normal task site owners may perform regularly.
Wordfence’s technical analysis says the plugin attempts to detect the site’s old table prefix during restore, but the regular expression used for that purpose can match text inside quoted values as well as actual SQL structure. In the reported case, that parsing mistake allowed captured text from the biography field to be reused in another SQL query without proper validation.
The report says this behavior could let an attacker shape the captured text so it is treated as a full SQL statement rather than a harmless table prefix. Because the plugin appends its own SQL afterward, the attacker can use SQL commenting to prevent the trailing statement from interfering.
Patch, mitigation, and Wordfence protection
Wordfence says it disclosed the issue to the Backuply team on September 28, 2026, and the developer released the patched version, 1.5.9, on October 1, 2026. Wordfence also commended the Backuply team for responding quickly and shipping a timely fix.
Before the patch landed, Wordfence had already deployed firewall protection for customers on its paid plans. Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule on September 24, 2026 to block known exploit attempts targeting the vulnerability. Users on the free version of Wordfence were scheduled to receive the same protection 30 days later, on October 24, 2026.
The advisory urges WordPress site owners to update to the latest patched release as soon as possible. At the time of publication, Wordfence identified version 1.5.9 as the fixed release.
What site owners should know
This vulnerability stands out because it can transform a low-privilege account into a full administrator account, but only if the attacker can get malicious content into the right place before a backup restore occurs. That still makes it a serious risk for sites that rely on Backuply for routine disaster recovery or migration work.
For site administrators, the practical takeaway is straightforward:
- Confirm whether Backuply is installed on any WordPress site you manage.
- Check that the plugin is updated to version 1.5.9 or later.
- Review whether backup restore workflows are used by administrators or other trusted users.
- Be aware that restoring an older backup containing malicious profile content could trigger the exploit path described by Wordfence.
Because the vulnerability involves a backup restore, it is easy to underestimate. But the chain described in the report is clear: attacker-controlled biography data is stored, backed up, and later executed during restore, potentially rewriting key site settings in the database.
Wordfence’s timeline
Wordfence provided a disclosure timeline showing the sequence of events leading to the public advisory. The company said it received the submission on 2026-09-17, validated the proof of concept on 2026-09-19, deployed the firewall rule for paid users on 2026-09-24, disclosed the vulnerability to the vendor on 2026-09-28, and saw the patched version released on 2026-10-01.
The final step in that timeline is the free firewall rollout, scheduled for 2026-10-24. Wordfence framed the multilayered response as part of its broader security approach, combining vulnerability research, responsible disclosure, and runtime protection.
The researcher credited with finding the issue is daroo, who reported it through the Wordfence Bug Bounty Program and received a $1,352.00 bounty. Wordfence said the discovery reflects the value of coordinated vulnerability research in the WordPress ecosystem.
For now, the important message for site operators is simple: if Backuply is present, make sure it is updated, and treat backup restores with the same care you would any administrative action that can affect the database. A vulnerability in a backup tool may sound indirect, but in this case it could have been enough to hand an attacker the keys to the site.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: October 15, 2026 at 10:32 pm
0 views
