Backuply through version 1.5.8 lets subscribers plant SQL that becomes administrator access on restore.
Wordfence disclosed CVE-2026-93953, an authenticated second-order SQL injection in the Backuply WordPress plugin, which has more than 600,000 active installations. Versions through 1.5.8 export the Biographical Info field unsafely into a backup SQL dump; when an administrator restores it, a subscriber or higher can execute SQL and change the default role to administrator, enabling site takeover. CVSS is 8.0. The flaw was reported September 17, patched in 1.5.9 on October 1, and Wordfence Premium received a firewall rule on September 24, with free users scheduled for October 24.
CVE-2026-93953 is a second-order SQL injection rated CVSS 8.0.
Subscriber-level users can plant SQL in the Biographical Info field.
The payload runs when an administrator restores a database backup.
It can set the default role to administrator and enable open registration.
Version 1.5.9, released October 1, 2026, fixes Backuply through 1.5.8.
Second-order SQL injection in Backuply WordPress plugin
The Backuply WordPress plugin (versions through 1.5.8) has a second-order SQL injection in how it handles the user Biographical Info field. The plugin writes that value verbatim into an INSERT statement in the backup SQL dump (wp_usermeta); when an administrator later restores the backup, a crafted value can break out of the INSERT and run additional SQL with full database privileges. An authenticated attacker with subscriber-level access or higher can use this to change stored options—notably setting default_role to administrator and enabling open registration—so a later registration becomes an administrator, leading to privilege escalation and full site takeover. The injection runs during restore and is suited to modifying records rather than reading data back to the attacker. It is not listed in CISA KEV, and no public proof-of-concept is known.
Full article2,617 words · extracted from wordfence.com · click to collapse
Do: Update the Backuply plugin to a release newer than 1.5.8 as soon as one is available from the vendor or WordPress.org. Until then, limit who can edit user profiles (including Biographical Info), restore only backups you trust, and after any restore check wp_options (especially default_role and user-registration settings) and recently created administrator accounts for unexpected changes.
8.0
—
Softaculous Backuply – Backup, Restore, Migrate and Clone all versions up to and including 1.5.8
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site.
Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,352.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org, on September 24, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on October 24, 2026.
We disclosed this vulnerability to the Backuply team on September 28, 2026, and the developer released the fully patched version on October 1, 2026. We would like to commend the Backuply team for their prompt response and timely patch.
We urge users to update their sites to the latest patched version of Backuply, version 1.5.9 at the time of this publication, as soon as possible.
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.
Backuply is a popular WordPress plugin for creating backups and restoring, migrating, and cloning sites. When creating a database backup, it exports each table’s rows into an SQL dump, and when restoring, it executes each statement from that dump to rebuild the database.
This vulnerability is a second-order SQL injection, meaning the malicious input is stored during one action and only becomes dangerous when it is processed later during a different action.
The malicious input is planted through the Biographical Info field, which any user with an account can set on their own profile. WordPress stores this value as plain text in the wp_usermeta table.
When a database backup is created, Backuply exports the stored biography as a normal quoted value inside an INSERT statement in the SQL dump, correctly escaping it as data. The flaw appears during the restore process. The importer executes each complete statement from the dump, and then applies an unanchored regular expression to that same statement in order to discover the site’s old table prefix. Because the expression is not limited to a real CREATE TABLE header and does not skip quoted values, it also matches text inside the stored biography. When the statement additionally contains the string backuply_version, the captured text is concatenated into a second UPDATE query without any validation:
```$bacuply_version_query="UPDATE ".$wp_old_prefix."options SET option_value='".$GLOBALS['backuply_version']."'WHERE `option_name`='backuply_version'``;";`
Because the captured value is placed directly into the UPDATE statement as if it were a trusted table prefix, an attacker can craft their biography so that the captured text is not a prefix at all, but a complete UPDATE statement of their choosing. By ending the captured portion with a comment character, the plugin’s own trailing SQL is discarded, and only the attacker’s statement is executed.
The injected statement targets two rows in the wp_options table, default_role and users_can_register, setting default_role to administrator and users_can_register to 1. Because wp_options is restored before wp_usermeta, these changes are already in place by the time the injected query runs and persist after the restore completes.
The significance of these two options is what turns a database write into a full site takeover. When users_can_register is enabled, WordPress exposes the public registration form, and when a new user is created without an explicit role, WordPress assigns them the value stored in default_role.
After an administrator restores a backup that contains the malicious value, public registration is enabled and the default role for new accounts is set to administrator. The attacker can then simply register a new account through the standard WordPress registration form, and that account is automatically granted the administrator role, giving the attacker complete control of the site.
As with all privilege escalation vulnerabilities, this can lead to complete site compromise.
Important Note
We would like to draw attention to the fact that this vulnerability requires an administrator to restore a database backup that was created after the attacker’s malicious biography value was stored. This restore is the action that causes the injected SQL to execute. Since creating and restoring backups is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until a restore takes place.
Disclosure Timeline
2026-09-17
We received the vulnerability submission
A security researcher submitted a second-order SQL injection vulnerability in Backuply through the Wordfence Bug Bounty Program.
2026-09-19
We validated the report
Our team confirmed the proof of concept and validated the report.
2026-09-24
We deployed a firewall rule to Premium users Firewall rule
We sent full disclosure details to the Backuply team.
2026-10-01
Vendor released patched version 1.5.9 Patch
The vendor released the fully patched version, 1.5.9, of the plugin.
2026-10-24
We will deploy the firewall rule to free users Firewall rule
Sites using the free version of Wordfence will receive the same protection 30 days later.
Wordfence action
Vendor / external action
Conclusion
In this blog post, we detailed a Second-Order SQL Injection vulnerability within the Backuply plugin affecting all versions up to, and including, 1.5.8. This vulnerability allows authenticated threat actors with subscriber-level access and above to store a malicious SQL payload that executes when an administrator restores a database backup, enabling them to enable public registration, set the default role to administrator, and register a new administrator account, leading to complete site compromise.
We encourage WordPress users to verify that their sites are updated to the latest patched version of Backuply as soon as possible considering the critical nature of this vulnerability.
Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org, on September 24, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on October 24, 2026.
If you know someone who uses this plugin on their site, we recommend sharing this advisory with them to ensure their site remains secure, as this vulnerability poses a significant risk.
Search
Trust Your Site
to the Leader in WordPress Security
Wordfence includes an endpoint firewall, malware scanner, robust login security features, live traffic views, and more. Discover why over 5 million WordPress sites put their trust in Wordfence.
Our business hours are 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays.
Response customers receive 24-hour support, 365 days a year, with a 1-hour response time.
This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
Cookie Settings Accept All Reject All
Cookie Options
For additional information on how this site uses cookies, please review our Privacy Policy. The cookies used by this site are classified into the following categories and can be configured below.
Strictly Necessary
Always active
The “Strictly Necessary” cookies are necessary for the Sites and Services to work properly, and cannot be disabled. They include any essential authentication and authorization cookies for the Services. If you select the “Reject All” button, or choose to do nothing, only the strictly necessary cookies are active by default.
Functional
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These cookies allow us to remember choices you make, such as your username, language, or region. This helps provide a more personalized and consistent experience by tailoring the Services to your preferences. For example, we can remember your preferred settings or login details, so you don't have to re-enter them each time you visit.
Performance/Analytical
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies allow us to collect certain information about how you navigate the Sites or utilize the Services running on your device. They help us understand which areas you use and what we can do to improve them.
Targeting
Disabled via "Do Not Sell or Share My Information" request. This category cannot be enabled.
Your browser is sending a Global Privacy Control signal which automatically disables this category. You may change your browser settings to enable it.
These Cookies are used to deliver relevant information related to the Services to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our Sites. Some of these types of Cookies on our Sites are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our Sites.
Cancel Save
Do Not Sell or Share My Personal Information
This form enables you to request that we stop selling or sharing your personal information with third parties. "Selling" includes exchanging your information for money or other benefits, while "sharing" refers to providing your data to third parties for targeted advertising purposes. For more information on how we process personal information, please review our Privacy Notice.
When you submit this form, we will:
Immediately disable retargeting and remarketing cookies on your current browser/device
Browser/Device Specific: This opt-out applies to the specific browser from which you submit the request. To opt out on additional devices or browsers, you will need to submit separate requests.
Cookie Management: You may also manage cookies directly through your browser settings, or on our Cookie Control form.
Do Not Sell or Share My Personal Information
Stop selling personal information about me to third parties for monetary or other valuable consideration.
Stop sharing personal information about me with third parties for cross-context behavioral advertising.
Your request has been received. We will no longer share or sell your personal information on this browser.
Cancel Submit
An error occurred while attempting to submit your request. Please try again or contact support.
István Márton
