600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin wordfence.com

Wordfence details a second-order SQL injection in Backuply, a backup plugin with over 600,000 installs, where a subscriber-level user can store a payload that runs when an admin restores a backup. It ends in privilege escalation to administrator, so check your sites are on the patched version.

Read it on Wordfence