{"id":"CVE-2026-93953","kind":"vulnerability","aliases":["CVE-2026-93953"],"related":[],"title":"Backuply WordPress plugin: SQL injection via restored user bio enables admin takeover","description":"The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.","summary":"The Backuply WordPress backup plugin up to and including 1.5.8 writes a user's Biographical Info field unescaped into a backup SQL dump, so a crafted value injects SQL when an administrator restores that backup. A subscriber-level account can thereby change the default_role option to administrator and enable open registration, leading to full site takeover.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["patched-version","plugin-not-installed","registration-closed"],"how_to_check":"- Check the installed Backuply version in the WordPress admin plugins list or with `wp plugin get backuply --field=version`\n- Review wp_options for `default_role` and users for unexpected administrator accounts","fix":"- Update the Backuply plugin to a version later than `1.5.8` (exact fixed version: unknown)\n- Until patched, deactivate Backuply or restrict restore to trusted backups and review user registration settings","status":"open","published_at":"2026-10-16T04:18:43+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:08:02+00:00","updated_at":"2026-10-25T03:08:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:08:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Backuply plugin to a version later than `1.5.8` (exact fixed version: unknown)\n- Until patched, deactivate Backuply or restrict restore to trusted backups and review user registration settings","reach":"internet","title":"Backuply WordPress plugin: SQL injection via restored user bio enables admin takeover","impact":"high","summary":"The Backuply WordPress backup plugin up to and including 1.5.8 writes a user's Biographical Info field unescaped into a backup SQL dump, so a crafted value injects SQL when an administrator restores that backup. A subscriber-level account can thereby change the default_role option to administrator and enable open registration, leading to full site takeover.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker becomes administrator and takes over the whole WordPress site","analyst_note":"Confirm the fixed Backuply version beyond 1.5.8 and whether the restore step needs an administrator to act, using the NVD entry and the plugin vendor's changelog.","how_to_check":"- Check the installed Backuply version in the WordPress admin plugins list or with `wp plugin get backuply --field=version`\n- Review wp_options for `default_role` and users for unexpected administrator accounts","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version","registration-closed"],"who_is_affected":"Sites running the Backuply plugin at version 1.5.8 or earlier where users can edit their Biographical Info field and administrators restore backups created by the plugin. Sites without Backuply installed, or running a newer version, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":3601,"output_tokens":632,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93953':15A,18A '1.5.8':36B,117C 'access':198C 'account':66B,231C 'admin':11A 'administr':58B,75B,160C,220C,236C 'append':176C 'arbitrari':203C 'attack':178C,193C,261C 'attacker-control':177C 'authent':192C 'automat':233C 'backup':30B,47B,61B,87C,152C,165C 'backupli':1A,28B,86C,138C 'bio':9A 'biograph':41B,102C,141C 'break':169C 'chang':69B 'clone':91C 'control':179C 'craft':52B,167C 'cve':13A,16A 'data':204C,275C 'databas':185C,207C,268C 'default':71B,213C 'direct':276C 'due':118C 'dump':49B,155C 'enabl':10A,77B,222C 'escal':241C 'escap':121C 'execut':182C,249C 'exist':135C,274C 'export':139C 'field':43B,104C 'full':82B,184C,243C 'grant':234C 'host':22B 'includ':35B,116C 'info':42B,103C,142C 'inject':5A,54B,99C,248C 'insert':147C,173C,252C 'insid':145C,250C 'insuffici':120C 'lack':129C 'later':161C 'lead':80B 'level':65B,197C 'make':188C 'migrat':89C 'modifi':267C 'open':78B,223C 'option':73B,215C,218C 'order':107C 'packag':19B 'paramet':126C 'particular':209C 'payload':168C 'plugin':3A,26B,31B,92C 'possibl':190C 'prepar':132C 'primit':263C 'privileg':186C,240C 'queri':137C 'rather':270C 'read':273C 'record':269C 'regist':230C 'registr':79B,225C 'respons':257C 'restor':7A,59B,88C,109C,162C,254C 'result':238C 'return':258C 'role':72B,214C,237C 'second':106C 'second-ord':105C 'self':21B 'self-host':20B 'site':83B,244C 'sql':4A,48B,55B,98C,136C,154C,180C 'statement':148C,174C 'subscrib':64B,196C 'subscriber-level':63B,195C 'subsequ':229C 'suffici':131C 'suppli':125C 'takeov':12A,84B,245C 'therebi':68B 'unescap':44B 'updat':211C 'use':265C 'user':8A,39B,124C,224C 'usermeta':157C 'valu':53B,143C 'verbatim':144C 'version':112C 'via':6A,100C,108C 'vulner':96C 'wordpress':2A,23B,25B,29B,94C 'wordpress-plugin':24B 'wp':156C,217C 'write':37B,202C 'written':149C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Backuply plugin at version 1.5.8 or earlier where users can edit their Biographical Info field and administrators restore backups created by the plugin. Sites without Backuply installed, or running a newer version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T04:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93953","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93953","severity":null,"published_at":"2026-10-16T04:18:43+00:00","modified_at":"2026-10-16T15:17:36+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}