A vulnerability in the Backuply WordPress plugin could allow attackers with subscriber-level access to gain administrator privileges and take complete control of a website. The flaw affects all versions up to 1.5.8 of the plugin, which has more than 600,000 active installations.
Security firm Wordfence disclosed the vulnerability on October 16, 2026, identifying it as CVE-2026-93953 with a CVSS score of 8.0. The developer has released a fix in Backuply version 1.5.9, and website owners should update the plugin immediately.
The vulnerability is a second-order SQL injection flaw. Unlike a typical SQL injection attack, the malicious input does not execute when an attacker submits it. Instead, the payload remains stored in the database until a later operation processes it in an unsafe way. In this case, that operation is the restoration of a database backup.
According to Wordfence, the attack begins with the Biographical Info field in a WordPress user profile. Users with subscriber-level access or higher can modify this field, allowing an attacker to store specially crafted input in their profile.
Backuply includes this information when exporting a website’s database. The problem occurs when the plugin later restores a backup containing the malicious input.
During restoration, Backuply uses a regular expression to identify the site’s previous database table prefix. Wordfence found that the expression is not restricted to actual table creation statements and can match text embedded in stored user data. The plugin then uses the captured text to construct another SQL query without sufficient validation.
An attacker can manipulate this process to inject an additional SQL statement that executes with database privileges during restoration. This allows the attacker to modify WordPress settings rather than directly retrieve information from the database.
The attack targets two options in the wp_options table: default_role and users_can_register. By setting the default role to administrator and enabling public registration, an attacker can make newly registered accounts receive administrator privileges.
Once these changes take effect, the attacker can register an account through the site’s normal registration form and gain control of the website. An administrator account can access sensitive site settings, install plugins, modify content, and potentially introduce additional malicious code.
However, exploiting the vulnerability requires a specific sequence of events. The attacker must first store the malicious input, and an administrator must then restore a database backup created after that input was added. The vulnerability does not automatically execute when someone visits the site or updates their profile.
Wordfence received the vulnerability report from security researcher daroo on September 17, 2026, and validated it two days later. The security firm disclosed the issue to the Backuply team on September 28, and the developer released the patched version, 1.5.9, on October 1.
The vulnerability earned the researcher a $1,352 bounty through Wordfence’s Bug Bounty Program.
Wordfence also deployed a firewall rule for its Premium, Care, and Response customers on September 24 to protect against known exploits targeting the vulnerability. Users of the free version are scheduled to receive the same protection on October 24, 2026.
This firewall rule provides an additional layer of protection, but it does not replace the need to install the patched plugin.
Website owners running Backuply should update to version 1.5.9 or a newer patched release. All versions up to and including 1.5.8 are affected.
Administrators should also review their user accounts and registration settings, especially if they restored a backup after an untrusted user could have added malicious input. Unexpected administrator accounts, unexplained changes to registration settings, and other suspicious database modifications could indicate a compromise.
Updating the plugin prevents exploitation through the known vulnerability, but it will not automatically reverse changes an attacker may have made earlier. If a website shows signs of compromise, its owner should investigate the incident, remove unauthorized accounts, review database settings, and check for malicious plugins or other unauthorized changes.
Techlomedia offers WordPress development and security services to help businesses build, maintain, and protect their websites. Services include WordPress development and customisation, security assessments, vulnerability fixes, malware cleanup, and website hardening. If you have a WordPress website, you can contact us for best-in-class development and maintenance services.
Related Posts
