CVE-2026-93953 with a CVSS score of 8.0 is a second-order SQL injection vulnerability in the Backuply WordPress plugin, affecting all versions up to, and including, 1.5.8. The flaw occurs in the plugin’s backup and restore functionality, specifically when a stored value from the WordPress user profile Biographical Info field is processed during a database restore. An attacker with authenticated subscriber-level access can plant a crafted SQL payload in that field, causing it to be exported into a backup SQL dump. Later, when an administrator restores the backup, the plugin uses an unanchored regular expression to identify the old table prefix, matches text inside the stored biography when the string backuply_version is present, and concatenates the captured text directly into an UPDATE query without validation. The injected statement can modify wp_options settings, enabling open user registration and changing the default role to administrator. This allows the attacker to register a new account that is automatically granted administrator privileges, leading to full site compromise, unauthorized data access, defacement, malicious configuration changes, and potential loss of confidentiality, integrity, and availability for the WordPress site.
We recommend you to update the Backuply WordPress plugin to version 1.5.9.[/subscribe_to_unlock_form]
CVE-2026-93953 with a CVSS score of 8.0 is a second-order SQL injection vulnerability in the Backuply WordPress plugin, affecting all versions up to, and including, 1.5.8. The flaw occurs in the plugin’s backup and restore functionality, specifically when a stored value from the WordPress user profile Biographical Info field is processed during a database restore. An attacker with authenticated subscriber-level access can plant a crafted SQL payload in that field, causing it to be exported into a backup SQL dump. Later, when an administrator restores the backup, the plugin uses an unanchored regular expression to identify the old table prefix, matches text inside the stored biography when the string backuply_version is present, and concatenates the captured text directly into an UPDATE query without validation. The injected statement can modify wp_options settings, enabling open user registration and changing the default role to administrator. This allows the attacker to register a new account that is automatically granted administrator privileges, leading to full site compromise, unauthorized data access, defacement, malicious configuration changes, and potential loss of confidentiality, integrity, and availability for the WordPress site.
We recommend you to update the Backuply WordPress plugin to version 1.5.9.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]