A flaw in Backuply, a WordPress backup plugin with more than 600,000 active installations, lets any logged-in user, down to the lowest subscriber role, plant a trap that fires the next time an administrator restores a backup and ends with the attacker owning the site. The developer fixed it in version 1.5.9 on October 1, 2026.
Wordfence published the details after the researcher known as daroo reported the bug through its bug bounty program, earning $1,352. Writing for Wordfence, István Márton explains the issue, tracked as CVE-2026-93953 and rated 8.0 (High) under CVSS. It affects every version up to and including 1.5.8.
A profile field that waits for a restore
This is a second-order SQL injection, meaning the malicious input is stored harmlessly during one action and only becomes dangerous when a later action processes it. Here the input goes into the Biographical Info field, which every WordPress user can edit on their own profile.
Backuply exports that biography correctly, as data, when it makes a backup. The problem is on restore. After executing each statement from the dump, the importer runs an unanchored regular expression over it to find the site's old table prefix, and that expression also matches text inside the stored biography. When the statement contains the string backuply_version, the captured text is dropped into a second UPDATE query with no validation, so a carefully crafted biography becomes an SQL statement of the attacker's choosing.
Wordfence shows how that becomes a takeover: the injected statement switches on public registration and sets the default role for new accounts to administrator. The attacker then simply signs up through the normal registration form and gets full control of the site.
Update Backuply to 1.5.9 before the next restore
The catch for attackers is timing. Nothing happens until an administrator restores a backup created after the malicious biography was saved. But restoring backups is the plugin's whole purpose, and Wordfence describes it as a routine action.
- Update Backuply to 1.5.9 or later.
- If you restored a backup recently while running 1.5.8 or earlier, confirm that user registration is still set the way you left it, that the default role for new users has not been changed to administrator, and review any recently created administrator accounts.
- Sites that let the public register, such as membership and community sites, carry the most exposure, because anyone can obtain the subscriber account the attack starts from.
Wordfence Premium, Care and Response customers have had a firewall rule since September 24, 2026. Sites on the free version of Wordfence receive it on October 24, 2026.
It is not the first time a backup plugin's restore path has been turned against WordPress sites, after a similar second-order flaw in All-in-One WP Migration. Backups are supposed to be the safe copy. A restore routine that trusts whatever is inside them turns recovery into the attack.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.