Backuply Vulnerability: How Subscribers Gain Admin Access

The plugin that got you was the one you trusted to keep you safe. That is the specific irony of the Backuply vulnerability disclosed earlier this year: a backup tool installed on over 600,000 WordPress sites contained a flaw that allowed an attacker with nothing more than a basic user account to seize full administrative control of the site. A free subscriber account was all an attacker needed to start the process.

The flaw is classified as an authenticated Path Traversal vulnerability, tracked as CVE-2025-2877. In plain terms: a logged-in user with subscriber-level access could manipulate the file path used during a restore operation, pointing it toward files outside the intended backup directory. By crafting a malicious restore request, an attacker could plant a backdoor or overwrite critical site files, and the damage fires the moment an administrator runs what looks like a routine restore. From the administrator’s perspective, they are doing exactly the right thing — maintaining their site, running a scheduled backup job — and in doing so, they hand the attacker the keys. The plugin was developed by Softaculous, a well-regarded name in hosting automation: a trusted maintenance utility, the kind businesses install precisely because they want their site protected. The fix is available in version 1.5.9.

What Administrator Access Actually Gives an Attacker

When someone gains administrator-level access to a WordPress site, the consequences are concrete and immediate. An attacker can create new administrator accounts and lock out the legitimate owner, install plugins that redirect all visitor traffic to a phishing page or malware distribution site, steal every customer record stored in the database — names, email addresses, order histories, any data your site holds — and inject code that skims payment details from your checkout. They can delete the site entirely, or quietly hold it in a compromised state for months, using it to send spam or host malicious files without your knowledge.

Google will eventually detect the malicious content and flag your domain, at which point your site disappears from search results and visitors see a browser warning before they can reach your pages. Recovering from a Google blacklisting takes weeks. The reputational damage to a business that customers can no longer trust to be safe is harder to quantify and harder to repair.

What makes this vulnerability particularly serious is the path from a subscriber account to that outcome. An attacker needs a user account on your site, which in many businesses is trivially easy to obtain: a customer who registered to place an order, a contact form submission that created an account, a free membership tier. Breaching your hosting account, cracking your administrator password, or exploiting your server configuration are all unnecessary.

Why Waiting for Auto-Update Is Not a Reliable Plan

WordPress has an auto-update mechanism, and many site owners assume it will handle security patches without any input from them. The mechanism exists and does work in some configurations, but it has meaningful gaps. Auto-updates can be disabled by a hosting environment, a theme, or another plugin; they can fail silently when there is a file permission issue or a server configuration conflict; and they run on a schedule, which means a vulnerability disclosed today may sit unpatched on your site for days before the automatic process fires.

In the case of Backuply, the patch was released in version 1.5.9. If your site is running any earlier version, it is exposed right now. The only way to confirm your status is to log in to your WordPress dashboard, go to Plugins, find Backuply, and check the version number displayed there. If it reads anything below 1.5.9, update it immediately.

Checking the version number takes two minutes. Plugin security monitoring is not most business owners’ job, and without a system that alerts them when it matters, the gap is understandable rather than negligent. A vulnerability like this one does not announce itself — your site continues to look and function normally while the exposure sits there. The only signal you might receive is a Google warning, a hosting suspension, or a customer telling you something looks wrong, all of which arrive after the damage is done.

There is one consequence that rarely gets discussed in the context of plugin vulnerabilities: insurance. If your business holds cyber liability cover, your insurer will ask whether you maintained reasonable security practices at the time of an incident. Running a known, publicly disclosed vulnerability for an extended period, one with a patch available and a CVE reference number, is a difficult position to defend. The exposure is on record, the fix was available, and whether you applied it is a matter of fact.

If you are running Backuply on your WordPress site, check the installed version today and update to 1.5.9 or later. If you are not certain which plugins are installed across your site, or whether your update process has any gaps, I offer a WordPress security audit at The WordPress Guy that covers exactly this: a full review of your installed plugins, their versions, known vulnerability status, and update configuration — so you know precisely what is exposed and what needs attention before an attacker finds it first.