Attributed metadata history
Up to 100 retained publisher events per page for c067ce6fa7bf610ef544f1d67e9559ccbbc7003b96ea96cf9a90853f07fc4c47. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_f9879f264b7a8ec1d7
observed · 2026-10-15 20:09:03 UTC
On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,352.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress
Fingerprint: 5f0a00d66c78d336e14759c6c3ebf84763e51fead81649b1138f6e2626d38139
intelligence_src_f9879f264b7a8ec1d7
observed · 2026-10-12 17:15:04 UTC
available
Fingerprint: cd55f3f7057add5a123a45847e8b00f32624ebea301db9e02e2a88688ac5a173