Backuply Backup Restore Migrate And Clone
Monthly
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.
Privilege escalation to full WordPress site takeover is possible in the Backuply backup/restore plugin (all versions up to and including 1.5.8) via a second-order SQL injection that an authenticated subscriber-level user plants in the profile Biographical Info field and that only fires when an administrator later creates a backup capturing that value and then restores it. During the restore the injected SQL executes blind inside an INSERT into wp_usermeta, allowing the attacker to alter database records - most notably to set the default_role option in wp_options to administrator and enable open registration, so a subsequently registered account is granted Administrator rights. Exploitation cannot be self-triggered by the attacker (UI:R) and requires a valid authenticated account (PR:L, no anonymous path); no public exploit identified at time of analysis.