CVE-2024-8669 Overview
The Backuply plugin for WordPress contains a SQL injection vulnerability [CWE-89] in the backuply_wp_clone_sql() function. The flaw affects all versions up to and including 1.3.4. The options parameter is passed to a SQL query without sufficient escaping or preparation. Authenticated attackers with administrator-level privileges can append arbitrary SQL statements to existing queries. Successful exploitation allows extraction of sensitive data from the WordPress database.
Critical Impact
Authenticated administrators can inject arbitrary SQL through the options parameter and exfiltrate database contents, including credentials and secrets stored by other plugins.
Affected Products
- Softaculous Backuply plugin for WordPress, all versions through 1.3.4
- WordPress sites using Backuply for Backup, Restore, Migrate and Clone operations
- Multi-site installations where administrator credentials are shared across sites
Discovery Timeline
- 2024-09-14 - CVE-2024-8669 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8669
Vulnerability Analysis
The vulnerability resides in the backuply_wp_clone_sql() function defined in the plugin's functions.php. The function accepts an options parameter supplied by the requesting user and incorporates it into a SQL query used during clone and migration operations. Because the parameter is neither escaped nor bound through $wpdb->prepare(), attacker-controlled input reaches the query as raw SQL syntax.
An attacker with administrator access can append UNION SELECT clauses or stacked expressions to read arbitrary rows from the wp_users, wp_usermeta, and wp_options tables. Sensitive data such as password hashes, session tokens, API keys, and secrets stored by other plugins become accessible through the response or through blind extraction techniques.
While administrator privileges are required, WordPress environments frequently grant administrator roles to multiple users, agencies, and third-party contractors. The vulnerability also lowers the bar for post-compromise persistence: an attacker who obtains a single admin session can pivot to extract secrets that enable lateral movement beyond WordPress itself.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command. The options value is concatenated into the query string instead of being bound as a parameter with $wpdb->prepare(). WordPress provides esc_sql() and prepared statements specifically to prevent this class of flaw, and neither is applied on the vulnerable code path.
Attack Vector
Exploitation is performed over the network against an authenticated administrator session. The attacker submits a crafted options payload to the plugin endpoint that invokes backuply_wp_clone_sql(). The injected SQL executes with the database privileges granted to the WordPress application user, typically full read and write access to the WordPress schema.
The vulnerability is tracked in the WordPress Plugin Code Review and the Wordfence Vulnerability Report.
Detection Methods for CVE-2024-8669
Indicators of Compromise
- HTTP POST requests targeting Backuply admin-ajax or plugin endpoints containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA within the options parameter
- Unexpected outbound queries against wp_users or wp_usermeta originating from the Backuply code path
- New or modified administrator accounts appearing shortly after Backuply endpoint activity
- Database error messages referencing malformed SQL near the backuply_wp_clone_sql() execution context
Detection Strategies
- Enable WordPress debug logging and inspect wp-content/debug.log for SQL syntax errors originating from Backuply
- Deploy a web application firewall rule that inspects the options parameter for SQL metacharacters on Backuply routes
- Correlate authenticated administrator sessions with sudden bursts of database read volume
Monitoring Recommendations
- Alert on any request to Backuply endpoints containing encoded or raw SQL syntax in POST bodies
- Monitor for administrator account creation, role changes, and password resets following plugin activity
- Track outbound connections from the WordPress host to identify data exfiltration attempts after successful injection
How to Mitigate CVE-2024-8669
Immediate Actions Required
- Update the Backuply plugin to a version later than 1.3.4 that includes the fix delivered in WordPress Changeset 3151205
- Audit all administrator accounts and remove unused or third-party admin access
- Rotate WordPress administrator passwords, database credentials, and any API keys stored in wp_options
- Review recent Backuply-related requests in access logs for signs of prior exploitation
Patch Information
Softaculous addressed the vulnerability in the changeset published at WordPress Changeset 3151205. The fix introduces proper parameter preparation on the query executed by backuply_wp_clone_sql(). Administrators should apply the update through the WordPress plugin manager and verify the installed version reports higher than 1.3.4.
Workarounds
- Deactivate and remove the Backuply plugin until the patched version is installed
- Restrict access to the WordPress admin area with IP allowlisting or a reverse-proxy authentication layer
- Enforce multi-factor authentication on all administrator accounts to reduce the risk of credential-based exploitation
- Apply least privilege to the WordPress database user, limiting access to only the tables required by the site
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
