SQL Injection Vulnerability in Backuply Plugin for WordPress

CVE-2026-93953

What is CVE-2026-93953?

The Backuply plugin for WordPress has a vulnerability that allows authenticated attackers to exploit SQL Injection via the Biographical Info field during restoration of backups. This occurs due to inadequate escaping of user input when constructing SQL queries, allowing attackers to inject arbitrary SQL commands. The vulnerability gives attackers with subscriber-level access the ability to manipulate database records, leading to potential privilege escalation, where an attacker can assign unauthorized roles such as Administrator to new accounts. This can result in a full site compromise, making it imperative for users to update to the latest version of the plugin.

References