Cpe:2.3:a:backuply:backuply:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3abackuplybackuplywordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 04:24:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-93953 - Second-Order SQL Injection in Backuply WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-10-backuply-sql-injection/Fri, 16 Oct 2026 04:24:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-backuply-sql-injection/The Backuply plugin for WordPress is vulnerable to second-order SQL injection, allowing authenticated attackers to achieve privilege escalation through malicious backup restoration.CVE-2026-93953 is a second-order SQL injection vulnerability affecting the Backuply - Backup, Restore, Migrate and Clone plugin for WordPress, impacting all versions up to and including 1.5.8. The vulnerability arises from improper escaping and insufficient preparation of SQL queries when handling user-supplied input, specifically within the Biographical Info field stored in the wp_usermeta table. An authenticated attacker with subscriber-level access can inject malicious SQL payloads into this field, which the plugin subsequently exports verbatim into a backup SQL dump file. When an administrator restores this crafted backup, the payload escapes the intended INSERT statement, executing arbitrary SQL commands with full database privileges. This exploitation chain enables attackers to modify database records, such as changing the default_role option to administrator and enabling open user registration, ultimately leading to unauthorized administrative access and full site takeover.

Attack Chain

  1. Attacker authenticates to the WordPress site with subscriber-level credentials.
  2. Attacker updates their profile Biographical Info field with a crafted SQL injection payload.
  3. The Backuply plugin executes a backup process, writing the malicious payload into a SQL dump file within the wp_usermeta insert statements.
  4. The attacker waits for an administrator to perform a site restore operation using the malicious backup file.
  5. The plugin reads the backup file and executes the INSERT statement, triggering the injection payload during the restoration process.
  6. The injected SQL executes with database-level privileges, updating the wp_options table.
  7. The attacker modifies the 'default_role' to 'administrator' and sets 'users_can_register' to '1'.
  8. Attacker or an automated bot registers a new account, which is automatically granted administrative privileges, resulting in full site takeover.

Impact

Successful exploitation results in full site takeover and unauthorized privilege escalation. Attackers can gain administrative control, potentially leading to total site compromise, data exfiltration, or defacement. Given the broad use of backup plugins in the WordPress ecosystem, this vulnerability poses a high risk to any site using Backuply version 1.5.8 or earlier.

Recommendation

  • Immediately update the Backuply plugin to the version containing the patch for CVE-2026-93953.
  • Review site administrative accounts for suspicious user accounts created via open registration.
  • Audit the wp_options table for unauthorized changes to the 'default_role' and 'users_can_register' settings.
  • Monitor database error logs for SQL syntax errors related to unexpected input in meta fields.
]]>highadvisoryweb-vulnerabilitywordpresssql-injectionprivilege-escalation