A major security flaw discovered in the widely used WordPress plugin “All-in-One WP Migration and Backup” puts over five million active sites at risk of full takeover. The bug, tracked as CVE-2026-19949, is an unauthenticated second-order SQL injection vulnerability in versions up to and including 7.109. The risk has been mitigated in version 7.110, released August 20, 2026.
What’s the risk?
The vulnerable plugin handles migrations by exporting website data—including files and database content—into .wpress archives. The flaw gives attackers a path to execute malicious SQL during the restoration process. It begins innocuously: an attacker submits a specially crafted trackback to a public WordPress post. This trackback data—using manipulated blog name or URL fields—is stored in the comments table without being executed.
During a later export‐and-restore using the plugin, the restoration code rewrites URLs and database table prefixes in SQL statements. Because of faulty regular expression handling of backslashes and quoted strings, the injected content from the comments table can escape its intended boundary and become active SQL. That allows reading the plugin’s ai1wm_secret_key, which should protect unauthorized import actions. With this key leaked, an attacker can upload a malicious .wpress archive—including a “must-use” plugin that loads by default—and gain remote code execution. This could let a malicious actor deploy webshells, steal data, or add malware.
Discovery, fix, and what to do now
The flaw was discovered August 14, 2026, by security researcher Jack Taylor via the Wordfence Bug Bounty Program, and was awarded a $5,761 bounty. It earned a CVSS severity score of 8.8. Wordfence deployed a firewall rule to protect Premium, Care, and Response users as of August 16. Free-for-all users received protection starting September 15. ServMask, the plugin developer, released the patched version 7.110 on August 20.
Site owners using the plugin should update immediately, disable trackbacks if not needed, audit recent comments for suspicious content, and ensure no unauthorized plugins or administrator accounts have been added.
This issue matters because backup and migration plugins are foundational tools in WordPress workflows, trusted to handle sensitive data safely. A flaw here undermines trust across millions of sites, from personal blogs to business platforms—but its remedy is straightforward. What to watch in the coming weeks: whether site owners apply the patch, whether exploit attempts spike, and whether similar second-order vulnerabilities exist in other plugins. But for now, updating and vigilance offer strong protection.
