Wordfence disclosed CVE-2026-93953 on 15 October 2026. It is a high-severity SQL injection in the Backuply WordPress plugin. The dangerous step is not the first login. It is the next database restore.
What happened
Backuply writes a user's biographical info into the SQL dump of a database backup. On versions through 1.5.8, a later restore can treat crafted text in that field as SQL and run it with full database rights. Wordfence rates the flaw CVSS 8.0. The official record confirms affected versions are 1.5.8 and earlier. Version 1.5.9, released on 1 October 2026, is the fix. Wordfence says the plugin has more than 600,000 active installations. There is no CISA KEV entry, and Wordfence has not said the flaw is being exploited in the wild.
Who is affected
- WordPress sites running Backuply 1.5.8 or earlier.
- Sites that let subscribers, customers, or other low-privilege users edit a profile biography.
- Sites where an administrator may restore a database backup taken after that biography was saved.
The attacker needs an account, at least subscriber level, and an administrator has to restore a backup that already contains the planted value. A restore of an older, clean backup does not trigger it.
What to do now
Update Backuply to 1.5.9 or later before the next database restore.
- Check the installed version under Plugins. If it is 1.5.8 or older, update before anyone restores a database backup.
- If a restore already happened after 1 October on an unpatched site, review new administrator accounts and the users_can_register and default_role options.
- Do not restore a database dump taken from an unpatched site until the plugin is updated.
- Prefer backups that do not include untrusted profile fields if you must restore in an emergency.
What this means for South African businesses
Backuply is a common free backup plugin on small WordPress shops, not an enterprise tool. The realistic risk for a South African SME is a customer or member account on a brochure site, not a remote attacker with no login. The failure mode is quiet: the site looks fine until the next restore, then a new registration becomes an administrator. Patch the plugin first, then treat any restore done on 1.5.8 or earlier since early October as worth a user-account check.
Source: Wordfence.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.