Backuply: Second-order SQL injection flaw, 600,000 WordPress sites at risk

Wordfence has disclosed a second-order SQL injection vulnerability in the Backuply – Backup, Restore, Migrate and Clone plugin, deployed on over 600,000 active WordPress sites. Hosting providers and site maintainers using this plugin should verify the installed version and update before performing any backup restoration.

How the vulnerability works

The flaw, tracked as CVE-2026-93953, affects the Biographical Info field in all versions up to and including 1.5.8 due to insufficient escaping of user-supplied input and failure to prepare an existing SQL query. It is not a direct injection: the payload remains dormant until an administrator initiates a database backup restore. During restoration, unsafe extraction of table prefixes and SQL query construction enable database updates controlled by the attacker. The practical outcome: an attacker can enable public registration and set the administrator role as default, allowing a newly registered account to take control of the site.

The attack requires only a subscriber-level account, the lowest tier of authenticated access in WordPress. The severity is rated CVSS 8.0 (High), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.

Timeline and patch

The vulnerability was discovered and responsibly reported by researcher daroo through the Wordfence Bug Bounty Program, earning a bounty of $1,352.00. Wordfence validated the report on 19 September 2026 and disclosed the vulnerability to the vendor on 28 September 2026. The Backuply team released version 1.5.9 on 1 October 2026 following the bug bounty report.

Who is protected and when

Wordfence Premium, Care and Response users received a firewall rule against known exploits of this vulnerability from the validation phase onwards. Free version users will receive protection on 24 October 2026: until that date the free firewall does not cover this flaw, so it is advisable not to delay and update immediately.

What to do

Site owners running Backuply should check the version from WordPress Plugin panel and, if below 1.5.9, update immediately, especially before performing any restoration from existing backups. The plugin is distributed by Softaculous and is available on the official wordpress.org/plugins/backuply repository.