If your site uses Backuply, update to version 1.5.9 or later before restoring a database backup. Versions through 1.5.8 contain a flaw that can give an attacker administrator access during a restore.
Wordfence’s advisory identifies the flaw as CVE-2026-93953 and rates its severity at 8.0 out of 10. The developer released the fix on October 1.
A restore triggers the attack
The attacker needs an existing account with subscriber permissions or higher. They can put malicious data in their profile biography, which then enters a database backup.
If an administrator later restores that backup, the plugin can run the stored data as database commands. Those commands can enable public registration and make new accounts administrators. The attacker can then register an account with full control.
Creating the backup alone does not trigger the attack. The dangerous step is restoring a database backup containing the malicious biography.
WPWithin previously covered a separate backup-restore flaw in All-in-One WP Migration. That article concerns a different plugin and patch.
End of article