Backuply WordPress Plugin Flaw Lets Subscribers Escalate to Site Takeover

En bref

• Authenticated subscriber-level accounts can store malicious SQL through the Backuply plugin
• The payload executes when an administrator restores a backup
• Successful exploitation yields privilege escalation and full site takeover
• Roughly 600,000 WordPress sites run the affected plugin
• No CVE has been assigned; Wordfence disclosed the issue on September 17, 2026

Wordfence disclosed on September 17, 2026 that Backuply, a widely used WordPress backup plugin, contains a stored SQL injection flaw. The issue can be triggered by any logged-in account, including users who hold nothing more than subscriber permissions — a role often handed out through open registration, comment systems, or membership plugins.

The attack chain is indirect. Rather than firing immediately, the injected SQL is saved into data that Backuply later processes. It only executes when an administrator initiates a backup restoration. Then, the specially designed query executes under higher-level database permissions, which lets the attacker elevate their privileges and eventually seize control of the entire website.

Roughly 600,000 WordPress installations are believed to run the affected plugin, making the exposure broad. Because subscriber accounts are trivial to obtain on many sites, the barrier to exploitation is low. No CVE identifier has been assigned, which can slow down vulnerability scanners and patch-tracking workflows.

The disclosure highlights a recurring theme in WordPress security: low-privilege users are not harmless. Plugins that defer processing — especially backup and restore tools — can turn a minor account into a stepping stone for full compromise. Administrators should treat backup functionality as a high-value target.

What to watch: a patched release from the plugin vendor, any signs of unexpected restore activity in logs, and whether other backup plugins share the same deferred-execution pattern. Until a fix lands, disabling Backuply or restricting restore permissions is the safest path.

À faire maintenant

1. Patch immediately: upgrade Backuply to the vendor's fixed release the moment it is available; if no patch exists, deactivate and remove the plugin.
2. Lock down restores: limit backup restoration rights to a small set of trusted administrators and require multi-factor authentication for those accounts.
3. Audit users: review all subscriber-level accounts, delete stale ones, and disable open registration if it is not essential.
4. Hunt for indicators: inspect recent backup archives and database tables for injected SQL strings, and review logs for unexpected restore events.
5. Deploy WAF rules: block common SQL injection patterns targeting backup endpoints while a patch is pending.
6. Preserve evidence: capture a clean backup and relevant logs before remediation in case forensic review is needed.
7. Monitor vendor channels: track Wordfence and the plugin developer for a CVE assignment and updated guidance.

Source originale

Wordfence