CVE-2026-93953: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in softaculous Backuply – Backup, Restore, Migrate and Clone

CVE-2026-93953 is a SQL Injection vulnerability in the Backuply WordPress plugin affecting all versions up to and including 1.5.8. The flaw arises because the Biographical Info field is exported verbatim into an SQL dump without proper escaping. During a restore operation, an attacker-controlled payload breaks out of the INSERT statement and executes arbitrary SQL with full database privileges. This enables attackers to escalate privileges by, for example, changing the default user role to administrator, allowing new accounts to gain admin rights. The injection occurs during the restore process and does not return direct query results to the attacker, focusing on modifying database state.

An authenticated attacker with subscriber-level access or above can exploit this vulnerability to escalate privileges to administrator by injecting SQL commands during a backup restore. This can lead to full site takeover, including unauthorized administrative control and enabling open user registration with admin privileges. The vulnerability impacts confidentiality, integrity, and availability of the WordPress site.

No patch links or vendor advisory are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles to trusted users only and avoid restoring backups from untrusted sources. Monitor for updates from the vendor regarding patches or official fixes.