CVE-2026-93953

Name of the Vulnerable Software and Affected Versions Backuply versions prior to 1.5.9

Description Backuply is subject to a second-order SQL Injection that allows authenticated users with subscriber-level access and above to escalate privileges and take full control of a site. The issue occurs when a user places a crafted string in the Biographical Info field of their profile. While the plugin exports this value into a backup SQL dump, the flaw triggers during the restoration process. Specifically, the plugin uses an unanchored regular expression to identify table prefixes that does not skip quoted values. If the Biographical Info contains the string backuply version, the crafted payload is executed within an UPDATE query with full database privileges.

This primitive allows attackers to modify database records, such as updating the default role option in wp options to administrator and enabling open user registration. Consequently, any subsequently registered account is automatically granted the Administrator role. This issue affects over 600,000 active installations.

Recommendations Update Backuply to version 1.5.9. As a temporary workaround, avoid restoring any backups created while subscribers had permission to edit their profiles until the update is applied.