Backuply WordPress plugin: Second-order SQL injection via restore
Summary
The Backuply plugin for WordPress up to and including 1.5.8 contains a second-order SQL injection in the Biographical Info profile field. The value is written unescaped into the SQL dump of a backup and executed when an Administrator restores that backup. An attacker with a Subscriber account or higher can use this to change database records, for example setting the default_role option to administrator, which can lead to full site takeover.
Affected
- Backuply plugin for WordPress, all versions up to and including 1.5.8
- Version 1.6.0 is mentioned by a single unverified secondary source and is not confirmed.
Fixed in
- Version 1.5.9 (reported by Wordfence and WPScan as the patched version)
Workaround
- No vendor-published workaround found.
- Wordfence reports that Premium, Care and Response customers received a firewall rule on September 24, 2026. This is not a substitute for patching.
- Avoid restoring backups from untrusted sources.
Exploitation
- Wordfence validated the report and confirmed a proof of concept.
- No confirmed exploitation in the wild found.
- Not listed in CISA KEV according to a third-party tracker; not verified directly.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Backuply to version 1.5.9 or later and confirm the installed version in the WordPress plugin screen.
- Prioritise sites with open user registration and sites where backups are restored manually.
- After any restore, review user accounts and the default_role option in the database.
- Restrict subscriber registration where it is not needed and monitor for new administrator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Wordfence threat intelligence record www.wordfence.com
- WordPress plugin changeset 3723257 plugins.trac.wordpress.org
- WPScan Backuply plugin wpscan.com
- NVD record via Vulners vulners.com
- Patchstack via Vulners vulners.com
- Malware.news Wordfence reproduction malware.news
- IT-Connect article on Backuply SQL flaw www.it-connect.tech
- Strix AI CVE record www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:17.
Original description (NVD)
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.
NVD references (6)
- https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L140
- https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/backup_ins.php#L592
- https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2247
- https://plugins.trac.wordpress.org/browser/backuply/tags/1.5.7/restore_ins.php#L2255
- https://plugins.trac.wordpress.org/changeset/3723257/backuply
- https://www.wordfence.com/threat-intel/vulnerabilities/id/202a2d02-a069-43d1-9ebe-59828e828c03?source=cve
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.