Imagine this: you restore a backup to fix a small problem on your website — and that very restore hands your entire site to a hacker. No phishing email. No stolen password. Just a routine backup restore that quietly turns an attacker into your site’s administrator. That is exactly what security researchers found in Backuply, one of the most popular WordPress backup plugins in the world.
I am Mei Chen, and I track WordPress security threats for a living. When Wordfence disclosed CVE-2026-93953 on October 16, 2026, I read the full technical analysis the same day — because a CVSS score of 8.0 on a plugin with more than 600,000 active installs is the kind of news that ruins weekends for site owners who ignore it.
If your site runs Backuply, here is the fear you should take seriously: an attacker with nothing more than a basic subscriber account could plant a hidden payload in their user profile, wait for you to restore a backup, and wake up as an administrator of your site. In this article, I will explain exactly what happened, how the attack works in plain language, and the exact steps to protect yourself today.
Whether you manage one blog or fifty client sites, this is the security briefing I wish every WordPress owner read before their next backup restore.
Here is what this article covers:
- What Happened: The Disclosure
- How the Attack Works (In Plain English)
- Who Is at Risk
- What To Do Right Now: The Fix Checklist
- How to Check If Your Site Was Already Compromised
- Frequently Asked Questions
- Final Thoughts
Let us get into it — starting with the facts.
What Happened: The Disclosure
On October 16, 2026, the WordPress security firm Wordfence published details of a critical vulnerability in Backuply, the popular backup, restore, migrate, and clone plugin. The flaw is tracked as CVE-2026-93953 and carries a CVSS severity score of 8.0 out of 10 — firmly in the “high” range. You can read the full [Wordfence disclosure](https://www.wordfence.com/blog/2026/10/600000-wordpress-sites-affected-by-sql-injection-vulnerability-in-backuply-wordpress-plugin/) and the official [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-93953) for the technical details.
Here is the timeline as Wordfence reported it. Security researcher “daroo” discovered the flaw and submitted it through the Wordfence Bug Bounty Program on September 17, 2026, earning a $1,352 bounty. Wordfence validated the issue on September 19 and notified the plugin developer on September 28. The developer released the fully patched version — Backuply 1.5.9 — on October 1, and Wordfence made the public disclosure on October 16. Wordfence also announced that firewall protection for its free users would roll out on October 24, 2026.
Two facts worth noting. First, as of the disclosure, there was no public proof-of-concept code and no confirmed active exploitation in the wild — this is a warning, not yet a fire. Second, that is exactly why you should act now: the window between disclosure and mass exploitation is when attackers study the write-up and build their attacks. I have watched this cycle many times. The sites that update in the first days are fine. The sites that “get to it later” are the ones that end up in incident reports.
How the Attack Works (In Plain English)
This is a “second-order” SQL injection. That sounds technical, so let me translate it into a story.
Think of it as a two-step trap. In step one, the attacker — who only needs a basic subscriber-level account on your site — types a specially crafted piece of text into the “Biographical Info” field of their WordPress user profile. WordPress saves this text harmlessly in its database, in a table called wp_usermeta. Nothing bad happens yet. The trap is planted but not triggered.
In step two, you — the site administrator — create or restore a backup with Backuply. When Backuply exports your database, it copies that biography text into the backup file. Later, when you restore the backup, Backuply’s restore process reads the file and runs a text-matching pattern (a “regular expression”) to figure out your database’s table prefix. Here is the flaw: that pattern was not careful enough. It matched text inside the attacker’s biography, and the plugin then glued that matched text directly into a database command without checking it first.
The result: the attacker’s hidden instructions execute with full database privileges during your restore. Specifically, the injected command rewrites two settings in your site’s wp_options table — it turns on open user registration (users_can_register) and changes the default new-user role to administrator (default_role). The attacker then simply registers a brand-new account on your site through the normal registration form — and WordPress happily grants that account full administrator privileges. Game over. Full site takeover.
What makes this especially nasty is the irony: the weapon is your own safety net. Backups exist to save you. Here, the restore process itself is the detonator. And because the malicious database command produces no visible output, you would have no idea it happened.
One more detail that matters: the attack requires the victim site to actually run a backup restore while the poisoned data is present. Sites that never restore backups are at lower immediate risk — but any site where users can register (even as subscribers) could already be carrying a planted payload in its database, waiting for the next restore. That is why updating matters even if you “never restore backups.”
Who Is at Risk
The short answer: every WordPress site running Backuply version 1.5.8 or older. With more than 600,000 active installations, that is a very large number of sites.
You are at higher risk if any of these are true. Your site allows user registration — even at the subscriber level — because that is all the access an attacker needs to plant the payload. You restore backups regularly, for example when moving between hosts or recovering from problems, because each restore is a potential detonation. You manage client sites with backup plugins installed and have not checked their versions recently.
You are at lower — but not zero — risk if your site has no open registration and you are the only user. An attacker would first need to obtain any authenticated account, which is a much higher bar. But “lower risk” is not “no risk,” and the fix takes two minutes. I have never regretted updating early. I have often regretted updating late.
A quick way to check: in your WordPress dashboard, go to Plugins and look at the Backuply version number. If it says 1.5.8 or anything lower, you are running the vulnerable code. If it says 1.5.9 or higher, you already have the fix.
What To Do Right Now: The Fix Checklist
Do these steps today, in this order. The whole process takes less than thirty minutes.
1. Update Backuply to 1.5.9 immediately. Go to Dashboard, then Updates, and update the plugin. If you use automatic updates, verify the version number afterward — do not assume. This single step closes the vulnerability completely.
2. Check who has accounts on your site. Go to Users and review every account. Look for subscriber-level accounts you do not recognize, especially ones created recently. The attack needs an authenticated account to plant the payload — unknown accounts are the first thing to investigate.
3. Inspect Biographical Info fields. This is tedious but important on high-value sites. Open suspicious user profiles and look at the Biographical Info field for strange text — random characters, fragments that look like code, or text mentioning database terms. Normal biographies read like sentences a human wrote. Payloads do not.
4. Check your wp_options for tampering. If you have database access (through phpMyAdmin in your hosting panel, for example), look at the wp_options table and confirm that default_role is set to your expected value (usually “subscriber”) and users_can_register matches your intended setting. If either was changed without your knowledge, treat the site as compromised and follow the next section.
5. Review your backup hygiene. This incident is a reminder of a bigger truth: your backups are only as safe as the data inside them. Keep multiple backup copies, store at least one copy off your own server, and test restores on a staging site before restoring on a live site. I wrote a full guide on [restoring a single file from a WordPress backup](https://hyperdaf.com/how-to-restore-a-single-file-from-a-wordpress-backup/) and on [why you should stop storing backups only on your own server](https://hyperdaf.com/stop-storing-wordpress-backups-on-your-own-server/) — both are worth reading this week.
6. Turn on automatic updates for plugins. Go to Plugins, enable auto-updates for Backuply and your other trusted plugins. The patched version 1.5.9 was available from October 1 — sites with auto-updates were protected two full weeks before the public disclosure. That two-week head start is the entire difference between “patched” and “exploited.”
How to Check If Your Site Was Already Compromised
Updating fixes the vulnerability going forward, but it does not undo an attack that already happened. Here is how I check a site after a disclosure like this.
First, look for administrator accounts you did not create. In Users, filter by the Administrator role and verify every single one. An attacker who succeeded would have created a new admin account — that account is their doorway back in. Delete any admin you do not recognize, and do it now.
Second, check the two targeted settings. In your database’s wp_options table, verify default_role and users_can_register are what you expect. If default_role says “administrator” and you did not set it that way, that is a smoking gun — the exact fingerprint of this attack.
Third, review recent user registrations and profile changes. Look at the Users list sorted by registration date. A burst of new subscriber accounts around the same time, especially with odd profile text, deserves investigation.
Fourth, scan your backup files. If you keep old backup archives from before the update, remember they may contain the planted payload in their SQL dumps. Do not restore a pre-patch backup onto a live site without checking it first — restoring is the trigger. If you must use an old backup, restore it on a staging copy first and inspect the user tables.
If you find evidence of compromise, do not just clean and move on. Change all passwords, regenerate security salts in wp-config.php, remove unknown accounts, restore from a known-clean backup made after the compromise date, and consider a professional malware scan. A takeover means the attacker may have planted additional backdoors beyond the one you found.
Frequently Asked Questions
I updated to 1.5.9. Am I completely safe now? From this specific vulnerability, yes — 1.5.9 closes the flaw. But updating does not remove an attack that already succeeded before you updated. Run the compromise checks above once, especially the administrator account review. After that, you are in good shape.
My site has no user registration. Do I still need to update? Yes. Update anyway. Your risk is lower, but plugin vulnerabilities sometimes combine with other flaws, and staying current is the cheapest security habit in WordPress. It takes two minutes.
What if I use a different backup plugin? This flaw is specific to Backuply’s restore code, so other backup plugins are not affected by CVE-2026-93953. But the lesson applies everywhere: keep every plugin updated, and be careful with restores. If you are evaluating backup options, read my comparison of [manual backups versus backup plugins](https://hyperdaf.com/manual-backups-vs-backup-plugins-whats-actually-safer/) to choose wisely.
Why did Wordfence wait until October 16 to disclose if the fix was out October 1? This is standard responsible disclosure. The researcher reported it privately, the developer was given time to build and release the fix, and only then did Wordfence publish details. The gap gives site owners a head start before attackers get the full technical write-up. It is the system working as designed.
Should I be worried about my old backup files? Mildly. Backups created while the vulnerability was present could contain a planted payload in their SQL dumps. Do not delete them in a panic — they may be your only recovery option — but never restore a pre-patch backup directly onto a live site. Restore to staging first, inspect, then proceed. My guide on [what to do when a WordPress backup fails](https://hyperdaf.com/wordpress-backup-failed-causes-and-fixes-that-work/) covers safe restore practices in detail.
Final Thoughts
Here is what stays with me about CVE-2026-93953. It was not found by a criminal — it was found by a researcher named “daroo” who reported it responsibly through a bug bounty program, earned $1,352, and gave the developer time to fix it before anyone got hurt. That is the security ecosystem working exactly as it should. The question is whether we, the site owners, do our part: update promptly, check our sites, and keep good backup hygiene.
The uncomfortable truth is that most compromised sites I have seen were not hacked through brilliant zero-days. They were hacked through known vulnerabilities with available patches that nobody installed. Backuply 1.5.9 has been available since October 1. If you have not updated yet, close this article and do it now — it takes less time than reading this sentence took.
And one broader lesson worth carrying forward: the quality of the code running your site matters more than any feature list. At HyperDAF, our own development team builds every WordPress product from scratch — themes, plugins, and tools — with security review baked into the process, not bolted on afterward. Our marketplace of our team’s own products launches very soon at hyperdaf.com. When it does, you will know exactly who wrote the code protecting your site — and that is worth more than any marketing claim.
Stay updated, stay backed up, and stay skeptical of “Biographical Info” fields from strangers. If this article helped you, share it with one person who runs a WordPress site — it might save their weekend.
