Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability
Do Son 
TL;DR
Wordfence disclosed a high-severity SQL injection vulnerability (CVE-2026-93953) in the Backuply WordPress plugin on October 15, 2026. The flaw allows authenticated subscribers to elevate their privileges and achieve full site takeover when an administrator restores a backup. Site owners must update to Backuply version 1.5.9 immediately to secure their installations.
- CVE: CVE-2026-93953
- CVSS: 8.0 (High · CVSSv3)
- Product: softaculous Backuply – Backup, Restore, Migrate and Clone
- Affected: ≤ 1.5.8
- Impact: Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
- Status: No confirmed exploitation yet
- Action: See vendor advisory
Why It Matters
Backuply is a widely used WordPress utility for creating backups and migrating or cloning websites. According to the official Wordfence security advisory, the extension has more than 600,000 active installations worldwide.
Security researcher daroo discovered CVE-2026-93953 (CVSS 8.8) and earned a $1,352.00 bug bounty reward. Wordfence notes that “As with all privilege escalation vulnerabilities, this can lead to complete site compromise.” Currently, no public proof-of-concept exists, and no active exploitation in the wild has been confirmed.
How the Attack Works
The flaw is a second-order SQL injection vulnerability. Wordfence explains that “the malicious input is stored during one action and only becomes dangerous when it is processed later during a different action.”
Payload Storage and Regex Flaw
First, an authenticated attacker with subscriber-level access plants a crafted SQL payload inside their profile’s Biographical Info field. WordPress saves this text in the wp_usermeta table, and the Backuply WordPress plugin exports it into the SQL dump during a database backup.
Later, when an administrator restores that backup, the importer runs an unanchored regular expression to detect the site’s old table prefix. Because the regex does not skip quoted values, it matches text inside the stored biography whenever the string backuply_version is present. Subsequently, the plugin concatenates the captured text directly into an UPDATE query without validation.
Privilege Escalation to Administrator
Consequently, the injected statement modifies two settings in the wp_options table. It enables open user registration by setting users_can_register to 1, and it changes default_role to administrator. As the advisory states, “The attacker can then simply register a new account through the standard WordPress registration form, and that account is automatically granted the administrator role, giving the attacker complete control of the site.”
Affected Versions
CVE-2026-93953 affects all versions of the Backuply WordPress plugin up to and including version 1.5.8. Version 1.5.9 is not affected.
Patch and Mitigation Steps
The plugin developers patched this issue in version 1.5.9. In its report, Wordfence states, “We urge users to update their sites to the latest patched version of Backuply, version 1.5.9 at the time of this publication, as soon as possible.” In addition, administrators should audit existing user profiles and verify that default registration roles remain restricted before restoring older database backups.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
