The Backuply WordPress plugin suffers from an SQL Injection vulnerability (CWE-89) in the backuply_wp_clone_sql() function due to insufficient escaping of the 'options' parameter. Authenticated attackers with administrator-level access can append malicious SQL queries to existing ones, enabling unauthorized data extraction from the database. This vulnerability affects all plugin versions up to 1.3.4. The CVSS 3.1 score of 9.1 reflects the critical impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an attacker with administrator privileges to execute arbitrary SQL commands on the WordPress database. This can lead to unauthorized disclosure of sensitive information, modification or deletion of data, and disruption of service. The vulnerability compromises the core security properties of the affected system, making it critical in severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity related to the Backuply plugin. Avoid using the vulnerable plugin version in sensitive environments. Follow updates from the vendor for an official patch or temporary mitigation.