{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3abackuplybackuplywordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:backuply:backuply:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8,"id":"CVE-2026-93953"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Backuply (\u003c= 1.5.8)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","wordpress","sql-injection","privilege-escalation"],"_cs_type":"advisory","_cs_vendors":["Backuply"],"content_html":"\u003cp\u003eCVE-2026-93953 is a second-order SQL injection vulnerability affecting the Backuply - Backup, Restore, Migrate and Clone plugin for WordPress, impacting all versions up to and including 1.5.8. The vulnerability arises from improper escaping and insufficient preparation of SQL queries when handling user-supplied input, specifically within the Biographical Info field stored in the wp_usermeta table. An authenticated attacker with subscriber-level access can inject malicious SQL payloads into this field, which the plugin subsequently exports verbatim into a backup SQL dump file. When an administrator restores this crafted backup, the payload escapes the intended INSERT statement, executing arbitrary SQL commands with full database privileges. This exploitation chain enables attackers to modify database records, such as changing the default_role option to administrator and enabling open user registration, ultimately leading to unauthorized administrative access and full site takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the WordPress site with subscriber-level credentials.\u003c/li\u003e\n\u003cli\u003eAttacker updates their profile Biographical Info field with a crafted SQL injection payload.\u003c/li\u003e\n\u003cli\u003eThe Backuply plugin executes a backup process, writing the malicious payload into a SQL dump file within the wp_usermeta insert statements.\u003c/li\u003e\n\u003cli\u003eThe attacker waits for an administrator to perform a site restore operation using the malicious backup file.\u003c/li\u003e\n\u003cli\u003eThe plugin reads the backup file and executes the INSERT statement, triggering the injection payload during the restoration process.\u003c/li\u003e\n\u003cli\u003eThe injected SQL executes with database-level privileges, updating the wp_options table.\u003c/li\u003e\n\u003cli\u003eThe attacker modifies the 'default_role' to 'administrator' and sets 'users_can_register' to '1'.\u003c/li\u003e\n\u003cli\u003eAttacker or an automated bot registers a new account, which is automatically granted administrative privileges, resulting in full site takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full site takeover and unauthorized privilege escalation. Attackers can gain administrative control, potentially leading to total site compromise, data exfiltration, or defacement. Given the broad use of backup plugins in the WordPress ecosystem, this vulnerability poses a high risk to any site using Backuply version 1.5.8 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Backuply plugin to the version containing the patch for CVE-2026-93953.\u003c/li\u003e\n\u003cli\u003eReview site administrative accounts for suspicious user accounts created via open registration.\u003c/li\u003e\n\u003cli\u003eAudit the wp_options table for unauthorized changes to the 'default_role' and 'users_can_register' settings.\u003c/li\u003e\n\u003cli\u003eMonitor database error logs for SQL syntax errors related to unexpected input in meta fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T04:24:30Z","date_published":"2026-10-16T04:24:30Z","id":"https://feed.craftedsignal.io/briefs/2026-10-backuply-sql-injection/","summary":"The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.","title":"CVE-2026-93953 - Second-Order SQL Injection in Backuply WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-backuply-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:backuply:backuply:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}