A second‑order SQL injection flaw exists in the Backuply WordPress plugin in the Biographical Info field that is written verbatim to the backup file. During a later restore, the injected payload breaks out of the INSERT statement and is executed with full database privileges. The attacker can modify entries such as the default_role option in wp_options, elevating a subscriber account to Administrator and enabling automatic administrator registration, leading to a full site takeover.

Softaculous Backuply plugin for WordPress versions up to and including 1.5.8 is affected.

The CVSS score is 8, indicating high severity. The EPSS score of < 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires an authenticated user with Subscriber level access or higher who can execute a restore operation. Once the restore is performed, the injected SQL runs with database-owner permissions, allowing an attacker to write arbitrary data. Because the attack occurs during a normal restore workflow and produces no direct output, detection is unlikely without monitoring backup files for malicious content.