Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-93953— Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

Quick assessment

Affected
softaculous Backuply – Backup, Restore, Migrate and Clone
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件"Backuply – Backup, Restore, Migrate and Clone"在所有 1.5.8 及以下版本中存在 SQL 注入漏洞。该漏洞源于对用户提供的参数缺乏充分转义，且对现有 SQL 查询未进行足够的预处理。具体而言，漏洞位于“个人简介”（Biographical Info）字段，属于通过恢复操作触发的二次注入。 Backuply 在生成备份的 SQL 转储文件（wp_usermeta）时，会将“个人简介”字段的值原样插入到 INSERT 语句中。当管理员后续恢复此类

CVSS 8.0 · High EPSS 0.34% · P26

Affected Version Matrix 1

VendorProduct Version RangeStatus
softaculous Backuply – Backup, Restore, Migrate and Clone ≤ 1.5.8 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-93953

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in all versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and the lack of sufficient preparation on an existing SQL query. Backuply exports the Biographical Info value verbatim inside an INSERT statement written to the backup's SQL dump (wp_usermeta). When an Administrator later restores such a backup, the crafted payload breaks out of that INSERT statement and appends attacker-controlled SQL that executes with full database privileges. This makes it possible for authenticated attackers, with subscriber-level access and above, to write arbitrary data to the database — in particular to update the default_role option in wp_options to administrator (and enable open user registration) — so that a subsequently registered account is automatically granted the Administrator role, resulting in privilege escalation and full site takeover. Because the injection executes inside an INSERT during restore with no response returned to the attacker, the primitive is used to modify database records rather than to read existing data directly.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
softaculous Backuply – Backup, Restore, Migrate and Clone 0 ~ 1.5.8 -

II. Public POCs for CVE-2026-93953

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-93953

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-93953 (1)

Vendor Pages for CVE-2026-93953 (1)

IV. Related Vulnerabilities

Same product: Backuply – Backup, Restore, Migrate and Clone
Same vendor: softaculous
Same weakness: CWE-89

V. Comments for CVE-2026-93953

No comments yet

Leave a comment