A second-order SQL injection vulnerability tracked as CVE-2026-19949 affects All-in-One WP Migration and Backup, a WordPress plugin with more than five million active installations used to back up and migrate entire websites between servers. The flaw, discovered by researcher Jack Taylor and reported through Wordfence in mid-August, stems from the plugin incorrectly parsing escaped backslashes and quotation marks while rewriting database content during archive restoration. An unauthenticated attacker can plant crafted data via WordPress trackbacks; the payload stays dormant until a site administrator runs a backup or import — routine operations for this plugin — at which point the stored data executes as SQL. Once that happens, the injected SQL can extract the plugin’s secret import key (ai1wm_secret_key) through a public comment, which the attacker can then use to upload a malicious .wpress archive containing arbitrary executable code, effectively taking complete control of the site.
The developer, ServMask, released version 7.110 on August 20, 2026, patching the issue after Wordfence disclosed it on August 15. However, WordPress.org statistics show that only about 35 percent of the plugin’s user base has updated, leaving roughly 3.25 million sites on vulnerable releases. Wordfence notes that even a deactivated version of the plugin remains exploitable if an administrator temporarily re-enables it to perform a site migration.
How to check if you’re affected
Affected versions of All-in-One WP Migration and Backup are 7.109 and older. Log in to your WordPress dashboard, go to Plugins → Installed Plugins, find “All-in-One WP Migration,” and check the version number. Any version through 7.109 is vulnerable. Update to version 7.110 (or later) immediately from the Plugins screen or from the WordPress plugin directory.
Sources
- BleepingComputer — WordPress backup plugin flaw exposes millions of sites to takeover attacks
- Wordfence Threat Intelligence — CVE-2026-19949 advisory (wordfence.com)