SQL Injection Flaw in Backuply Plugin Exposes 600,000 WordPress Sites to Takeover

Wordfence disclosed a high-severity SQL injection vulnerability in the Backuply WordPress plugin on September 17, 2026. The flaw allows authenticated attackers with minimal subscriber-level access to store malicious SQL code that executes when an administrator restores a database backup, potentially granting them full administrative control over the site.

According to Wordfence, the issue is a second-order SQL injection that persists in the database until triggered by a backup restoration process. This mechanism enables attackers to escalate their privileges from subscriber to administrator, effectively allowing them to take over the compromised WordPress site. The plugin currently supports more than 600,000 active installations, making the potential impact widespread across the WordPress ecosystem.

Vulnerability Mechanics and Disclosure

The vulnerability was submitted to Wordfence on September 17, 2026, according to the security firm’s blog post. The attack vector requires an attacker to have an authenticated account with at least subscriber-level permissions. Once logged in, the attacker can inject a malicious SQL payload into the plugin’s data storage. This payload remains dormant until a site administrator performs a database backup restoration, at which point the SQL command executes with elevated privileges.

This type of second-order injection is particularly dangerous because the malicious input is not executed immediately upon entry. Instead, it is stored and processed later during a legitimate administrative action. This delay can make detection difficult, as the initial injection may not trigger immediate errors or security alerts. The successful execution of the payload grants the attacker administrator-level access, bypassing standard permission controls.

Affected Systems and Scope

The Backuply WordPress plugin is the sole product identified in this disclosure by Wordfence. With over 600,000 active installations, the plugin is widely used for managing database backups on WordPress sites. Any site running this plugin with an authenticated user account is potentially vulnerable to this privilege escalation attack. The severity of the issue stems from the ease with which an attacker can gain full control of the site infrastructure through a routine backup operation.

Wordfence highlighted the scale of the exposure in its initial report, noting the significant number of installations affected. The vulnerability does not require unauthenticated access, but the low barrier of subscriber-level permissions makes it accessible to a broad range of potential attackers. Sites that allow user registration or have compromised low-level accounts are at heightened risk.

What should you do?

Site administrators should review user permissions and ensure that only trusted individuals have access to backup restoration features. Monitoring for unauthorized database changes or unexpected administrative actions can help detect exploitation attempts. Until a patch is confirmed, limiting the number of users with subscriber-level access may reduce the attack surface. Organizations should also verify the integrity of their backup files before restoring them to mitigate the risk of executing stored malicious payloads.