Wordfence disclosed a high-severity SQL injection in the Backuply – Backup, Restore, Migrate and Clone plugin on October 15, 2026 (CVE-2026-93953, CVSS 8.0). The flaw is “second-order”: a subscriber-level account plants a payload in the Biographical Info profile field, and it fires only when an administrator restores a backup — at which point it can rewrite the site’s default user role to administrator, opening the door to full site takeover. All versions through 1.5.8 are affected; the fix ships in Backuply 1.5.9. The plugin powers more than 600,000 active installations, and the reporting researcher earned a $1,352 bug bounty.
This one deserves attention because backup plugins run with maximum trust — a restore-time trigger turns a routine recovery task into a takeover vector. Update to Backuply 1.5.9 before your next restore, and if a restore was performed recently, have a professional review the site and user accounts.
Managing plugin updates across client sites is exactly what our website care plans handle — updates, security monitoring, and backups reviewed by a human, not just a button. Learn more at https://qamardigitalventuresllc.com/
Source: Wordfence (October 2026).
