www.it-connect.fr
Backuply SQL Flaw Puts 600,000 WordPress Sites at Risk During Restores
A simple user with a subscriber role slips a few lines into their bio, an administrator restores a WordPress backup a few days later... and the website changes hands. That is the scenario made possible by a flaw in Backuply, a plugin installed on more than 600,000 sites. Here’s what you need to know.
Backuply, developed by Softaculous, is used to back up, restore, migrate, and clone WordPress sites. On October 15, 2026, Wordfence published a security bulletin about a SQL injection vulnerability tracked as CVE-2026-93953 and rated 8.0 out of 10 on the CVSS scale.
It affects all versions of the plugin up to and including 1.5.8. The fix has been available since October 1, 2026 with Backuply 1.5.9, whose changelog mentions a fix for an issue related to the restore process. Thanks to this finding, reported on September 17, the researcher behind the discovery received a $1,352 bounty.
In this case, it is a so-called second-order SQL injection, meaning nothing happens when the malicious data is first saved. The trap is triggered later, when that data is reused by another function in the application. Here, it is the restoration of WordPress through the vulnerable plugin that acts as the trigger.
From Bio to Administrator Account
The entry point is the Biographical Info field in the WordPress profile. This is a default field that can be edited by any user, including those with the Subscriber role (the lowest privilege level). During a backup, Backuply exports it correctly into the SQL file, as a value inside an INSERT statement. Things go wrong on the way back, during restoration.
To recover the table prefix from the old site, Backuply parses each statement in the file with an overly permissive regular expression, which can also capture the bio content. That text is then inserted as-is into an SQL query executed by the plugin. In plain terms, the attacker gets to execute the query of their choice, with full rights on the database.
According to Wordfence, the injected query changes two options in the wp_options table:
- users_can_register : set to 1, it enables public registration on the site.
- default_role : set to
administrator, it assigns the Administrator role to any new account created without an explicit role.
All that is left is to register through WordPress’s standard form to obtain an administrator account!
A Restore Is Required to Trigger the Flaw
There is one important condition: an administrator must restore a database backup created after the malicious bio was saved. "Since creating and restoring backups is the very purpose of this plugin, this is routine behavior, but the injected SQL will not run until a restore takes place," Wordfence explains.
In other words, the threat mainly targets sites that allow account creation (communities, membership platforms, and so on), or those where a low-privilege account has already been compromised. Still, people do not restore their WordPress site every morning, so it takes a very specific chain of events for the attack to succeed.
In any case, if you use Backuply, move to version 1.5.9 right away.
