Attributed metadata history

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site. Introduction to Malware Binary Triage (IMBT) Course Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor. Enroll Now and Save 10%: Coupon Code MWNEWS10 Note: Affiliate link – your enrollment helps support this platform at no extra cost to you. Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,352.00 for this discovery. Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security. Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule to protect against known exploits targeting this vulnerability in Backuply, hosted on WordPress.org, on September 24, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on October 24, 2026. We disclosed this vulnerability to the Backuply team on September 28, 2026, and the developer released the fully patched version on October 1, 2026. We would like to commend the Backuply team for their prompt response and timely patch. We urge users to update their sites to the latest patched version of Backuply, version 1.5.9 at the time of this publication, as soon as possible. Vulnerability Summary from Wordfence Intelligence Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation 8.0 CVSS Rating 8.0 (High) <div> CVE-ID<br /> <strong> <a href="https://www.cve.org/CVERecord?id=CVE-2026-93953" rel="noreferrer" target="_blank"> CVE-2026-93953 </a> </strong> </div> <div> Affected Version(s)<br /> <strong><= 1.5.8</strong> </div> <div> Patched Version<br /> <strong>1.5.9</strong> </div> <div> Bounty<br /> <strong>$1,352.00</strong> </div> </div> <div> <div> <strong>Affected Software</strong><br /> <div><a href="https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/backuply" rel="noreferrer" target="_blank">Backuply – Backup, Restore, Migrate and Clone</a> [backuply]</div> </div> <div> <strong>Researcher</strong><br /> <div> <div><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daroo-2" rel="noreferrer" target="_blank"><img alt="" src="https://www.gravatar.com/avatar/7965cd13376a540548ec7009cd66b05b.jpg?s=32&d=mp&r=g" /></a><a href="https://www.wordfence.com/threat-intel/vulnerabilities/researchers/daroo-2" rel="noreferrer" target="_blank">daroo</a></div> </div> </div> </div> <div> The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.