Loading vulnerability…
CVE-2026-93953 is a second-order SQL injection vulnerability affecting the Backuply – Backup, Restore, Migrate and Clone WordPress plugin through version 1.5.8. An authenticated user with Subscriber privileges or higher can store malicious text in their profile's Biographical Info field. Although the biography is initially escaped during backup export, restoration uses an unanchored regular expression to extract a database table prefix from SQL statements. This expression can match attacker-controlled text inside a quoted biography rather than an actual table-definition header. When a processed statement also contains the backuply_version marker, the extracted prefix is concatenated into a subsequent UPDATE query without validation. Restoring the affected backup therefore executes attacker-controlled SQL with the database connection's privileges, enabling arbitrary database modifications and potential site takeover.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity second-order SQL injection vulnerability in Backuply for WordPress, rated CVSS 3.1 8.0. An authenticated user with Subscriber privileges or higher can place a malicious payload in their Biographical Info field, which Backuply embeds without sufficient escaping in a backup SQL dump. If an administrator subsequently restores that backup, attacker-controlled SQL executes with full database privileges. Attackers can enable user registration and change the default role to Administrator, allowing a newly registered account to take over the site. Exploitation requires an administrator to restore the poisoned backup; the described technique modifies database records rather than directly returning existing data.
A high-severity second-order SQL injection vulnerability (CVSS 8.0) affects Backuply versions through 1.5.8. An authenticated user with subscriber-level privileges or higher can store malicious content in their profile biography. Exploitation requires an administrator to create a database backup containing that content and subsequently restore it. During restoration, an unanchored regular expression can extract attacker-controlled text from the biography as a table prefix and concatenate it into an UPDATE query without validation. The resulting database write can enable public registration and set the default user role to administrator, allowing the attacker to register an administrator account and take over the site. A proof of concept was validated. Version 1.5.9 fixes the vulnerability.
A high-severity second-order SQL injection vulnerability (CVSS 8.0) affects Backuply versions through 1.5.8, potentially exposing more than 600,000 WordPress installations. An authenticated user with subscriber-level access or higher can plant malicious text in their profile biography. Exploitation requires an administrator to restore a database backup created after that text was stored. During restoration, an unanchored regular expression can interpret biography content as a table prefix and concatenate it into an unsafe UPDATE query. An attacker can enable public registration and set the default account role to administrator, then register an administrator account and take over the site. Version 1.5.9 fixes the vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.