Backuply <= 1.5.8 - Unauthenticated Second-Order SQL Injection via Backup Restoration

ID

WPSEC-2026-0328

Plugin

Backuply – Backup, Restore, Migrate and Clone (backuply)

Affected

all versions before 1.5.9

Remediation

Update to 1.5.9 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness

CWE-89

Usage

Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22

Attack surface

Backuply on WPSec AttackSurface

Fix released

2026-10-01

Published

2026-10-02

Description

The Backuply plugin for WordPress is vulnerable to second-order SQL Injection via the backup restoration process in all versions up to, and including, 1.5.8. The cause is that the old table prefix is extracted with a loose regular expression from every SQL statement being restored, including INSERT statements that hold user-supplied data such as comment text. That prefix is then concatenated without escaping into an UPDATE query. This makes it possible for unauthenticated attackers to plant crafted text (for example in a comment) that results in arbitrary SQL being executed when an administrator later restores a backup containing that data. Successful exploitation requires an administrator to perform a restore of a backup that includes the attacker-supplied content.

References

• https://wpsec.com/vuln/WPSEC-2026-0328/
• https://plugins.svn.wordpress.org/backuply/tags/1.5.9/
• https://wordpress.org/plugins/backuply/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS