Backuply WordPress plugin flaw can enable site takeover
The Backuply WordPress plugin contains a high-severity SQL injection vulnerability that can turn an ordinary subscriber account into full administrator access after a database backup is restored. Wordfence says the issue affects every Backuply version up to and including 1.5.8. The developer released patched version 1.5.9 on October 1, 2026. Backuply, formally named Backuply - Backup, Restore, Migrate and Clone, has more than 600,000 active installations.
The vulnerability is tracked as CVE-2026-93953 and has a Common Vulnerability Scoring System (CVSS) rating of 8.0, classified as High. SQL injection is a security flaw in which attacker-controlled content becomes part of a database command. In this case, the issue is a second-order SQL injection: the malicious content is stored first and remains inactive until the plugin processes it during a later operation. An attacker must already have an authenticated WordPress account with the subscriber role or higher.
The attack begins with the Biographical Info field that registered users can edit in their profiles. WordPress stores this value in the wp_usermeta database table. If Backuply creates a database backup after the malicious biography has been saved, that value becomes part of the SQL dump, which is a file containing database commands and stored information used to rebuild the database. The payload does not execute when the biography is entered or when the backup is created. It is triggered only if an administrator later restores the affected backup.
Wordfence found that Backuply's restore process executes statements from the SQL dump and then uses an unanchored regular expression to identify the old WordPress table prefix. A table prefix is the opening part of database table names that distinguishes one WordPress installation's tables. The expression is not restricted to a genuine CREATE TABLE header and does not ignore quoted values, allowing it to match crafted content inside the stored biography. If the same statement also contains backuply_version, the captured content is inserted into a second UPDATE query without validation.
An attacker can therefore design the biography so the captured value is treated as a database command rather than a table prefix. A comment character can discard the rest of the plugin's generated query. Wordfence's demonstrated path modifies the default_role and users_can_register entries in the wp_options table, enabling public registration and making Administrator the automatic role for newly registered accounts. Because wp_options is restored before wp_usermeta, those changes are already present when the injected query runs and remain after restoration. The attacker can then use the normal registration form to create a new account with administrator privileges and take control of the site.
The injected operation runs during an INSERT statement and does not return a response to the attacker. Wordfence therefore described it as a way to change database records rather than directly retrieve existing data. The critical condition is the restore step: an administrator must restore a database backup created after the malicious profile value was stored. Until that happens, the stored payload does not run. Backup creation and restoration are central functions of the plugin, making this condition operationally relevant even though exploitation is not immediate.
Wordfence received the vulnerability submission on September 17, 2026, validated the proof of concept on September 19 and issued a firewall rule to its Premium, Care and Response users on September 24. The company disclosed the issue to the Backuply team on September 28, and version 1.5.9 followed on October 1. Wordfence said users of its free product would receive the same rule on October 24, 30 days after the initial deployment. The researcher who submitted the vulnerability through the Wordfence Bug Bounty Program received $1,352. The firewall rule was described as protection against known exploits targeting the WordPress.org-hosted plugin, but updating Backuply remains the recommended corrective action.
Website owners should confirm that Backuply is running version 1.5.9 or later, review subscriber accounts and treat backups created while a vulnerable version was active with care. After restoring such a backup, administrators should verify that public registration has not been enabled unexpectedly and that new users are not assigned the Administrator role. For organisations that prefer operational support for their sites, AEU Hosting provides managed WordPress hosting secured end to end.