600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin 

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a malicious SQL payload that is executed when an administrator later restores a database backup, ultimately allowing the attacker to escalate their privileges to administrator and take over the site.
The post 600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin appeared first on Wordfence.WordfenceRead More