Wordfence disclosed a second-order SQL injection in Backuply, a backup/restore plugin with more than 600,000 active installs (CVE-2026-93953, CVSS 8.0, versions 1.5.8 and earlier). Any subscriber can put a payload in their profile's Biographical Info field. Backups export it safely, but the restore code runs an unanchored regex over each SQL statement and pastes the match into a second UPDATE query. When an admin restores, the payload can, for example, set default_role to administrator and open registration, so the next new account becomes an admin. Fixed in 1.5.9 (released Oct 1). Wordfence Premium firewall rules have been out since Sept 24; free users get them Oct 24. It matters most on sites with open registration.