---
title: Backuply WordPress plugin (600K+ sites) CVE-2026-93953: subscriber plants SQL in their bio that runs when an admin restores a backup | ctxsec
url: https://ctxsec.com/items/backuply-cve-2026-93953
description: ""
status: "confirmed (Wordfence); no known exploitation"
published: 2026-10-15
---

> 

[← Cybersecurity News](/news) · [markdown](/items/backuply-cve-2026-93953.md)

confirmed (Wordfence); no known exploitation

2026-10-15

### Backuply WordPress plugin (600K+ sites) CVE-2026-93953: subscriber plants SQL in their bio that runs when an admin restores a backup

Wordfence disclosed a second-order SQL injection in Backuply, a backup/restore plugin with more than 600,000 active installs (CVE-2026-93953, CVSS 8.0, versions 1.5.8 and earlier). Any subscriber can put a payload in their profile's Biographical Info field. Backups export it safely, but the restore code runs an unanchored regex over each SQL statement and pastes the match into a second UPDATE query. When an admin restores, the payload can, for example, set default_role to administrator and open registration, so the next new account becomes an admin. Fixed in 1.5.9 (released Oct 1). Wordfence Premium firewall rules have been out since Sept 24; free users get them Oct 24. It matters most on sites with open registration.

Sources: [Wordfence](https://www.wordfence.com/blog/2026/10/600000-wordpress-sites-affected-by-sql-injection-vulnerability-in-backuply-wordpress-plugin/)