CVE-2026-93953

Executive Summary

CVE-2026-93953 is a second-order SQL injection in the Backuply — Backup, Restore, Migrate and Clone WordPress plugin, affecting all versions up to and including 1.5.8. An authenticated attacker with only subscriber-level access can persist a crafted payload in the Biographical Info user-meta field, which Backuply writes verbatim into the SQL dump (wp_usermeta) it generates; when an Administrator restores that backup, the injected SQL executes with full database privileges. Because the injected statement can update the default_role option in wp_options to administrator and enable open registration, a subsequently registered account is automatically granted Administrator rights — a full site takeover with a CVSS base score of 8.0.

Technical Analysis

The vulnerability is a classic second-order SQL injection (CWE-89). The defect has two components that compound across time and privilege boundaries:

1. Insufficient escaping on storage/export. Backuply does not escape the user-supplied Biographical Info value when it exports it. The value is written verbatim inside an INSERT statement for the wp_usermeta table in the backup's SQL dump.

2. Lack of sufficient preparation on restoration. When an Administrator later restores the backup, the INSERT statement containing the unsanitized value is executed. Because the value was never escaped, a payload placed in the Biographical Info field can break out of the INSERT statement and append attacker-controlled SQL.

The attack surface is the WordPress user profile mechanism (Biographical Info / user meta), reachable by any authenticated account with subscriber-level access and above. The exploit requires user interaction (UI:R) on the part of an Administrator to trigger the restore operation — the attacker cannot force the restore, but can wait for or socially engineer an administrator-driven backup restoration.

Because the injection executes inside an INSERT during the restore and no response is returned to the attacker, this is a write-only primitive rather than a data-exfiltration vector. The described impact is therefore integrity- and availability-focused modification of database records rather than direct read of existing data. CVSS reflects this via C:H/I:H/A:H with S:U (privilege boundaries are crossed within the same security authority — the database).

No public PoC or exploit code is reported (POC_STATUS: None; Nuclei: NO), and no EPSS score has been assigned. The specific SQL statement construction, payload syntax, and the intermediate serialization format are not documented in the available description; implementation-level detail beyond the export/INSERT/restore flow is not derivable from the provided data.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. No function names, endpoints, or parameters are asserted beyond those stated in the source description.

1. Reconnaissance / target identification. The attacker identifies a WordPress site running the Backuply plugin at a version <= 1.5.8. Because the vulnerability requires only subscriber-level authentication, the reconnaissance bar is low: any site with open registration (or any attacker holding a low-privileged account) is a candidate.

2. Triggering the flaw class (second-order injection via Biographical Info). The attacker authenticates with subscriber-level access and writes a crafted SQL payload into the Biographical Info profile field. At this stage the value is stored as user meta. No database error or response reveals the injection — it is dormant.

3. Payload persistence into the backup artifact. The attacker induces or waits for Backuply to create a backup. During export, the Biographical Info value is written verbatim inside an INSERT statement for wp_usermeta in the resulting SQL dump. The unescaped payload is now embedded in the backup artifact.

4. Execution during restore (requires Administrator action). When an Administrator restores that backup, the INSERT statement is executed without sufficient preparation, and the attacker's appended SQL breaks out of the original statement. The injected SQL runs with full database privileges.

5. Post-exploitation impact. Per the description, the attacker uses the write primitive to set the default_role option in wp_options to administrator and to enable open user registration. The attacker then registers a new account, which is automatically assigned the Administrator role. This yields privilege escalation and full site takeover.

The user-interaction requirement (UI:R) means the attack is not autonomous: the restore must occur. Practical exploitation depends on an administrator restoring a poisoned backup, which may be routine in operational workflows or induced through social engineering.

Impact Assessment

• Confidentiality: High (C:H). Full site takeover implies access to all site data available to an Administrator, including user records, content, and plugin/theme configuration.
• Integrity: High (I:H). The attacker can write arbitrary data to the database, including security-critical options such as default_role, and can create an Administrator account.
• Availability: High (A:H). Administrator-level control permits destructive actions against the site and its database, including data deletion or site defacement.
• Scope: Unchanged (S:U). The impact stays within the WordPress/MySQL security authority.
• Attack Vector: Network (AV:N), Attack Complexity: Low (AC:L), Privileges Required: Low (PR:L), User Interaction: Required (UI:R).

Business impact includes complete compromise of the affected WordPress installation and any data or downstream systems reachable through it. Because the escalation path targets role assignment (default_role) rather than direct credential theft, detection may depend on configuration monitoring rather than authentication anomaly signals. Site owners who rely on Backuply as part of disaster-recovery workflows are exposed at the exact moment they believe they are restoring a trusted state.

Affected systems: any WordPress installation running Backuply <= 1.5.8. The blast radius includes all users and content on the site, plus any credentials, integrations, or customer data exposed through the installation.

Detection Guidance

Sigma Rule

title: Suspicious SQL Keywords in WordPress user-meta Export or Restore Activity
id: 8b3f9d2a-5c71-4e26-9a4d-2f6b1c0e7a10
status: experimental
description: Detects SQL-injection-style payloads appearing in WordPress user meta or in Backuply backup/restore activity, consistent with CVE-2026-93953 second-order SQL injection via the Biographical Info field.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93953
author: valtersit.com
date: 2026-01-01
logsource:
  category: application
  product: wordpress
detection:
  selection_meta:
    event:
      - 'wp_usermeta_update'
      - 'profile_update'
      - 'user_meta_update'
  selection_terms:
    meta_value|contains:
      - ');'
      - '--'
      - 'UNION'
      - 'UPDATE wp_options'
      - 'default_role'
      - 'INSERT INTO'
  condition: selection_meta and selection_terms
falsepositives:
  - Legitimate user biographies containing SQL-like text
level: high
tags:
  - attack.t1190
  - cwe.89

YARA Rule

rule CVE_2026_93953_Backuply_SecondOrder_SQLi
{
    meta:
        description = "Detects SQL-injection-style payloads in Backuply backup dumps or WordPress wp_usermeta exports referenced by CVE-2026-93953"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93953"
        date = "2026-01-01"
        severity = "high"

    strings:
        $wp_usermeta = "wp_usermeta" ascii nocase
        $insert = "INSERT" ascii nocase
        $bio = "biographical" ascii nocase
        $default_role = "default_role" ascii nocase
        $susp1 = "');" ascii
        $susp2 = "-- " ascii
        $susp3 = "/*" ascii

    condition:
        ($wp_usermeta or $bio) and $insert and ($default_role or any of ($susp*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93953 Backuply / WordPress second-order SQL injection payload in profile or restore request"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; content:"backuply"; nocase; http.request_body; content:"default_role"; nocase; http.request_body; content:"wp_options"; nocase; reference:cve,2026-93953; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-93953; classtype:web-application-attack; sid:202693953; rev:1;)

Elastic Detection

sequence by user.name with maxspan=30d
  [ any where event.action == "profile_update" and user.name != null and process.name != null ]
  [ any where event.action in ("user_registered", "user_role_changed") and
        (user.roles : "administrator" or event.reason : "default_role") ]

Splunk SPL Query

index=wordpress (sourcetype=wordpress:access OR sourcetype=wordpress:syslog)
| search (uri="*backuply*" OR uri="*profile.php*" OR uri="*user-meta*")
| eval payload=coalesce(request_body, meta_value, message)
| where match(lower(payload), "default_role|update\s+wp_options|insert\s+into\s+wp_usermeta|\)\s*;")
| stats count min(_time) as first_seen max(_time) as last_seen values(payload) as payloads by src_ip, user, uri
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,backuply,sql_injection,">
  <rule id="202693953" level="12">
    <if_sid>31100,31500,31560</if_sid>
    <id>^1000</id>
    <match>default_role|wp_options|wp_usermeta|UNION|INSERT INTO</match>
    <description>CVE-2026-93953: possible second-order SQL injection via Backuply/WordPress profile or restore activity</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web,appsec,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

Immediate mitigations

• Restrict plugin availability and remove Backuply <= 1.5.8 from production sites until a verified fix is confirmed.
• If the plugin must remain active, restrict Administrator-driven backup restore operations to a controlled maintenance window and review any out-of-band restore requests with suspicion.
• Limit subscriber-level registration on affected sites and disable open user registration where operationally feasible, since the escalation technique depends on attacker-triggered account creation.
• Audit wp_options for unauthorized changes to default_role and disable self-service user registration.
• Review and purge stored Biographical Info values containing SQL metacharacters, and re-generate any backup artifacts created while untrusted users held subscriber access.

Patch/upgrade steps

• Monitor NVD and the Backuply vendor distribution channel for a patched release. The patch status is currently a single-source claim; independently verify the fixed version before relying on it.
• Because affected versions are recorded as "all versions up to and including 1.5.8," upgrading beyond 1.5.8 is the presumed remediation, but no confirmed fixed version is published — verify against the vendor before deployment.
• After upgrade, invalidate and rebuild existing backup artifacts that may contain poisoned wp_usermeta INSERT statements.

Long-term hardening

• Enforce defense-in-depth at the database layer: use least-privilege accounts for backup/restore processes, parameterized queries in custom plugin code, and never execute serialized or exported application data as raw SQL.
• Adopt managed database roles so that restore operations run under an account without the ability to modify security-critical options (e.g., default_role) unless explicitly required.
• Implement configuration-change alerting on WordPress options that govern privileges (default_role, users_can_register, role mappings).
• Maintain an inventory of installed plugins and versions, and subscribe to vendor and CNA advisories for prompt patching.

References

• NVD — CVE-2026-93953: https://nvd.nist.gov/vuln/detail/CVE-2026-93953
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — not yet scored for CVE-2026-93953 (do not cite a fabricated score): https://www.first.org/epss/
• CISA KEV Catalog — CVE-2026-93953 is not listed at time of writing: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public exploit code, PoC, or exploit-in-the-wild evidence is available for CVE-2026-93953 at the time of writing. No threat actor campaign has been associated with this CVE. The report is derived from the NVD description and the vulnerability class (CWE-89), and no implementation detail beyond that description should be assumed.