Backuply, a 600,000-install WordPress plugin, has a backup-restore SQLi bug
CVE-2026-93953 lets a subscriber plant SQL in their own bio that fires when an admin restores a backup. Fixed in Backuply 1.5.9.
Backuply, a WordPress backup plugin with over 600,000 active installs, carries a second-order SQL injection flaw tracked as CVE-2026-93953, disclosed today. Versions up to and including 1.5.8 write a user’s Biographical Info field straight into an INSERT statement when generating a backup’s SQL dump, with no escaping. The payload sits dormant in the dump file until an administrator restores that backup, at which point it runs as SQL against the live database.
Any logged-in subscriber, the lowest WordPress role, can set the malicious bio themselves. Wordfence rates it CVSS 8.0. The fix shipped in version 1.5.9 on 1 October, credited to a Wordfence researcher.
Why it matters: a backup plugin is exactly the thing you trust to be safe to restore. If your site allows open registration or membership sign-ups and runs Backuply, update to 1.5.9 before you next restore from a backup taken on an older version, since the malicious payload would already be sitting in it.
The caveat: exploitation needs an admin to actually restore a tainted backup, so it’s not remotely triggerable on its own. Update regardless, it costs nothing.