SECURITYONLINE [.]info reports a high-severity SQL injection vulnerability in the Backuply WordPress plugin, tracked as CVE-2026-93953. Wordfence disclosed the flaw on 15 October 2026, with a CVSS v3 score of 8.0 (High). The vulnerability affects all versions up to and including 1.5.8; version 1.5.9 is stated as patched and not affected. The advisory notes that there was no public PoC and, at the time of reporting, no confirmed exploitation in the wild.
The attack is a second-order SQL injection that relies on authenticated input stored during one action and later triggered during a separate action. An authenticated subscriber can inject a crafted payload into their profile Biographical Info field, which is saved to wp_usermeta and later exported by the Backuply plugin during a database backup.
When an administrator restores that backup, the importer uses an unanchored regular expression to locate the site’s old table prefix and improperly concatenates the captured text into an UPDATE query without proper validation. This enables modification of two wp_options settings: users_can_register is set to 1, and default_role is changed to administrator. Consequently, an attacker could register a new account and be granted administrator privileges, effectively taking full control of the site.
Mitigation actions recommended include updating to Backuply 1.5.9 and auditing existing user profiles to ensure default registration roles remain restricted before restoring older backups. The article also references Wordfence’s advisory and notes the broad use of Backuply, with over 600,000 active WordPress installations.