CVE-2026-93953

8.0High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.0High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-89

Impact

Authenticated users with subscriber access or higher can achieve full site takeover and database tampering if an administrator restores a backup. The attack requires the user to submit malicious SQL in their profile's Biographical Info field, which executes during a subsequent restore operation.

Root cause

The plugin writes the Biographical Info field verbatim into the backup's SQL dump without sufficient escaping, allowing SQL injection when the dump is executed during a restore.

Affected systems

Backuply plugin for WordPress up to, and including, version 1.5.8

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade Backuply to a version newer than 1.5.8. If you cannot patch immediately, disable the Backuply plugin or refrain from restoring any site backups generated while untrusted user registrations were permitted.

shell

$ wp plugin update backuply

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-93953