As cited
Copy frozen at (site build).
vulnerabilities
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
A second-order SQL injection vulnerability (CVE-2026-93953, CVSS 8.0) in the Backuply WordPress plugin affects 600,000 sites running version 1.5.8 and earlier. An authenticated subscriber-level user can inject a malicious SQL payload into their biographical info field that executes when an administrator restores a backup, allowing the attacker to escalate privileges to administrator and take over the site. The patch, version 1.5.9, was released on October 1, 2026, and Wordfence deployed firewall protection to premium users on September 24, 2026, with free user protection rolling out on October 24, 2026.
Why it matters: WordPress administrators managing Backuply backups need to update all sites to version 1.5.9 immediately, as any subscriber-level attacker on a site can pre-stage a payload that executes during routine backup restoration operations, leading to complete site compromise.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
A second-order SQL injection vulnerability (CVE-2026-93953) in the Backuply WordPress plugin affects over 600,000 installations. Subscribers and higher-level users can inject malicious SQL through the Biographical Info field that executes when an administrator restores a backup, allowing privilege escalation to administrator and full site takeover. Backuply released patched version 1.5.9 on October 1, 2026.
Why it matters: WordPress site administrators using Backuply up to version 1.5.8 must update immediately to 1.5.9, as any subscriber-level account holder can compromise the entire site through a backup restore operation.
- Source published
- First seen by Cybersecurity Tracker