Second-order SQL injection in Backuply WordPress plugin
CVSS 3.1
8.0high
EPSS
—
Published
()
Modified
AI analysis
The Backuply WordPress plugin (versions through 1.5.8) has a second-order SQL injection in how it handles the user Biographical Info field. The plugin writes that value verbatim into an INSERT statement in the backup SQL dump (wp_usermeta); when an administrator later restores the backup, a crafted value can break out of the INSERT and run additional SQL with full database privileges. An authenticated attacker with subscriber-level access or higher can use this to change stored options—notably setting default_role to administrator and enabling open registration—so a later registration becomes an administrator, leading to privilege escalation and full site takeover. The injection runs during restore and is suited to modifying records rather than reading data back to the attacker. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Update the Backuply plugin to a release newer than 1.5.8 as soon as one is available from the vendor or WordPress.org. Until then, limit who can edit user profiles (including Biographical Info), restore only backups you trust, and after any restore check wp_options (especially default_role and user-registration settings) and recently created administrator accounts for unexpected changes.
Affected
Softaculous Backuply – Backup, Restore, Migrate and Clone
all versions up to and including 1.5.8
Estimated exposure
large≈600,000 WordPress sites — A related headline reports about 600,000 WordPress sites affected, consistent with the plugin’s active-install footprint on WordPress.org.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.
Backuply through version 1.5.8 lets subscribers plant SQL that becomes administrator access on restore.
Wordfence disclosed CVE-2026-93953, an authenticated second-order SQL injection in the Backuply WordPress plugin, which has more than 600,000 active installations. Versions through 1.5.8 export the Biographical Info field unsafely into a backup SQL dump; when an administrator restores it, a subscriber or higher can execute SQL and change the default role to administrator, enabling site takeover. CVSS is 8.0. The flaw was reported September 17, patched in 1.5.9 on October 1, and Wordfence Premium received a firewall rule on September 24, with free users scheduled for October 24.