Backuply WordPress plugin flaw enables site takeover
A Backuply WordPress plugin vulnerability can let an attacker with an ordinary subscriber account plant malicious database instructions that execute later, when an administrator restores a backup. Wordfence says the flaw affects every Backuply version up to and including 1.5.8, potentially exposing more than 600,000 active installations. The fully patched release is version 1.5.9.
The issue is tracked as CVE-2026-93953 and has a Common Vulnerability Scoring System (CVSS) rating of 8.0, classified as High. CVSS is a standard scale for describing the severity of a security flaw. This is a second-order SQL injection, meaning hostile database commands are saved during one action but do not run until a separate action processes the stored content later.
According to Wordfence, an authenticated attacker with subscriber-level access or higher can place the payload in the Biographical Info field of their WordPress profile. WordPress stores that biography as plain text in the wp_usermeta table. Backuply then includes it as an escaped, quoted value when creating an SQL dump, which is a file containing database commands used to rebuild the database. At that stage, the biography is stored as data and the attack has not yet executed.
The dangerous step occurs during restoration. Backuply runs each complete statement from the dump and uses an unanchored regular expression, a text-matching rule that is not restricted to the start of the statement, to identify the old WordPress table prefix. A table prefix is the shared beginning of WordPress database table names, such as the portion before “options.” Wordfence found that the expression is not limited to a genuine CREATE TABLE header and does not ignore quoted values, so it can match specially prepared text inside the stored biography.
If the same statement contains the string backuply_version, the text captured as the supposed table prefix is inserted into a second UPDATE query without validation. An attacker can therefore design the biography so the captured material is a complete database UPDATE statement rather than a real prefix. A comment character at the end causes the plugin’s remaining query text to be ignored, leaving the attacker-controlled statement to run with full database privileges.
The demonstrated payload changes two records in the wp_options table. It sets default_role to administrator and users_can_register to 1. The first setting makes administrator the role assigned to a new account when no role is explicitly provided, while the second enables public user registration. Wordfence notes that wp_options is restored before wp_usermeta, so the changed settings are already present when the injected query executes and remain in place when restoration finishes.
After the restore, the attacker can use the normal WordPress registration form to create another account. Because registration is open and the default role is administrator, that account receives full administrative control of the site. The injected query runs inside an INSERT operation and returns no response to the attacker, so this technique is used to alter database records rather than directly retrieve existing information.
There is an important prerequisite: the administrator must restore a database backup created after the malicious biography was saved. Merely entering the biography does not execute the SQL. Wordfence nevertheless considers the scenario significant because creating and restoring backups is Backuply’s central function, making restoration a normal administrative activity.
Wordfence received the report through its Bug Bounty Program on September 17, 2026, validated the proof of concept on September 19 and paid the researcher $1,352. It provided Wordfence Premium, Wordfence Care and Wordfence Response users with a firewall rule against known exploits on September 24. A firewall rule is a filtering instruction intended to block matching malicious requests. Wordfence disclosed the vulnerability to the Backuply team on September 28, and the developer released version 1.5.9 on October 1. Sites using the free Wordfence edition were scheduled to receive the same rule on October 24, 30 days after the paid editions.
Administrators should update Backuply to 1.5.9 or later before restoring a database backup. They should also inspect WordPress registration settings and administrator accounts, particularly if a backup was restored while an affected version was installed. A firewall rule can provide another defensive layer, but it does not replace installing the corrected plugin release.
For site owners who prefer not to manage WordPress security alone, AEU Hosting offers managed WordPress hosting, secured end to end. Regardless of hosting arrangement, the direct response to this flaw is to replace Backuply 1.5.8 or earlier with the patched version and review the site for unexpected administrator access.