On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site.
Props to daroo who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $1,352.00 for this discovery. Our mission is to
Click here to continue reading this article.
