Loading story…
A high-severity second-order SQL injection vulnerability in the Backuply WordPress plugin potentially exposes more than 600,000 active installations to full site takeover. Tracked as CVE-2026-93953 with a CVSS score of 8.0, the flaw affects versions through 1.5.8. An authenticated attacker with subscriber-level access or higher can place malicious content in their Biographical Info field. Exploitation requires an administrator to restore a database backup containing that content; unsafe table-prefix extraction and SQL query construction during restoration then allow attacker-controlled database updates. An attacker could enable public registration and set administrator as the default role, allowing a newly registered account to take control of the site.
Backuply released version 1.5.9 on October 1, 2026, after researcher daroo reported the vulnerability through the Wordfence Bug Bounty Program. Administrators should update Backuply promptly, particularly before restoring database backups. Wordfence deployed firewall protection for paid users on September 24, while protection for free users is scheduled for October 24, 2026; organizations should prioritize patching rather than rely solely on firewall coverage.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
The Backuply developer released version 1.5.9 with a fix for the vulnerability affecting all versions through 1.5.8.
Wordfence notified the Backuply team of the SQL injection vulnerability.
Wordfence deployed a firewall rule protecting against known exploits for the vulnerability to Premium, Care, and Response users.
Wordfence validated the report and confirmed the proof of concept for the Backuply second-order SQL injection vulnerability.
Researcher daroo submitted the vulnerability later identified as CVE-2026-93953 through the Wordfence Bug Bounty Program. The flaw affects Backuply versions through 1.5.8.
Wordfence detailed CVE-2026-93953, a CVSS 8.0 vulnerability in a plugin with more than 600,000 active installations. A subscriber-level attacker can plant malicious profile data that triggers SQL injection during an administrator's database restore, enabling public registration with administrator privileges and subsequent site takeover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcemalware.news
Open sourcewordfence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity unauthenticated second-order SQL injection flaw, **CVE-2026-19949** (CVSS 8.8), affects the All-in-One WP Migration and Backup WordPress plugin through version 7.109, exposing roughly 5 million sites. Attackers can plant malicious data through unauthenticated WordPress trackbacks; the payload is triggered only if an administrator later exports and restores the affected site using the plugin, where faulty regular-expression handling converts stored comment data into executable SQL. Successful exploitation can expose the plugin's `ai1wm_secret_key`, allowing an attacker to invoke its unauthenticated import action with a crafted `.wpress` archive. That archive can install a malicious must-use plugin and yield remote code execution, potentially resulting in complete site compromise. ServMask addressed the flaw in version 7.110; Wordfence released a firewall rule to paid customers and scheduled free-tier coverage for September 15.
Sep 8, 2026
A critical authentication bypass in the **UpdraftPlus: WP Backup & Migration** WordPress plugin, tracked as `CVE-2026-10795`, is being actively exploited against sites running versions up to and including `1.26.4`. The flaw affects a plugin installed on more than three million WordPress sites and stems from insufficient validation in UpdraftCentral remote procedure call handling, including signature-verification weaknesses and unchecked decryption return values that can collapse to a predictable all-zero key. Wordfence reported blocking **4,987** exploitation attempts in a 24-hour period. Successful exploitation lets unauthenticated attackers impersonate the connected administrator and issue arbitrary RPC actions, including uploading and auto-activating a malicious plugin for **remote code execution** and full site compromise. The vulnerability has been classified under `CWE-347`, with a `CVSS v3.1` vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The issue was reportedly discovered by researcher **vtim**, and the vendor released a patch that adds stricter return-value validation; administrators are being urged to update immediately.
Jun 29, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026