3.25 million sites are still running a version of the All-in-One WP Migration and Backup plugin that contains CVE-2026-19949, a high-severity vulnerability that can lead to remote code execution and full site takeover.
CVE-2026-19949: a second-order SQL injection in archive restoration
Security researcher Jack Taylor discovered the flaw in mid-August and reported it through Wordfence, the cybersecurity arm of Defiant. The vulnerability is tracked as CVE-2026-19949 and received a high-severity score. Wordfence researchers describe the issue as a second-order SQL injection that affects All-in-One WP Migration and Backup versions through 7.109.
The core fault lies in incorrect parsing of escaped backslashes and quotation marks while the plugin rewrites database content during archive restoration. That string-handling error lets injected SQL remain dormant until a later operation—specifically, when an administrator exports and then imports a site archive.
All-in-One WP Migration and Backup: what the plugin does and how widespread it is
The All-in-One WP Migration and Backup plugin is used to back up, export, import, and move entire WordPress sites, including databases, media, themes, and plugins, between servers or domains. According to WordPress.org statistics cited by the researchers, the plugin has more than five million active installations.
Given the plugin’s central role in moving site content and databases, many administrators routinely perform the export/import operations that will trigger the vulnerable parsing behavior—creating a practical pathway for exploitation if malicious content is present in the database.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogExploit mechanics: trackbacks, secret import key, and dormant payloads
Wordfence explains the exploitation chain in three concrete steps. First, an unauthenticated attacker can plant crafted data via WordPress trackbacks. That planted data does not execute immediately; instead the injected SQL is stored in the site’s data.
Second, when an administrator later runs an export and import—typical maintenance or migration actions—the plugin rewrites database content during archive restoration, mis-parsing escaped characters and thus executing the stored SQL. The injected SQL can disclose the plugin’s secret import key (ai1wm_secret_key) via a public comment.
Third, with the secret import key obtained, the attacker can import a malicious “.wpress” archive that includes executable code. Wordfence notes that code execution at this privilege level may lead to taking complete control of the target website.
The requirement that an administrator perform an export/import reduces the immediate attack surface, but as Wordfence observes, “Since backup and restore is the core purpose of this plugin, this is a routine action, but the injected SQL will not execute until it takes place.”
ServMask’s patch, disclosure timeline, and current uptake
Wordfence validated Taylor’s finding and disclosed the issue to the plugin’s developers, ServMask, on August 15. ServMask addressed CVE-2026-19949 on August 20 with the release of version 7.110.
Despite the available fix, only approximately 35% of the plugin’s user base has updated to the patched version; the remaining 3.25 million sites continue to run a vulnerable release. Wordfence also warns that a deactivated vulnerable version poses less risk but can still be exploited if it is temporarily activated.
How technologists, site administrators, and threat actors are affected
- Technologists and security teams: will need to inventory sites using All-in-One WP Migration and Backup, verify version numbers, and prioritize updates to 7.110. They should also consider scanning for signs of injected SQL and for suspicious public comments that could exfiltrate the ai1wm_secret_key.
- Site administrators and enterprises using the plugin: face practical risk because the routine restore operations that enable maintenance also trigger the vulnerability. Administrators should delay imports until confirming the plugin is updated, and treat temporarily activating an outdated plugin as a potential vector for compromise.
- Adversaries and threat actors: gain a clear path for staged exploitation—planting data that remains inert until an admin-initiated archive restore—and, if successful, using the exposed ai1wm_secret_key to import code-bearing archives that yield remote code execution and possible full takeover.
The record here is concrete: a high-severity CVE, a working remediation, and millions of installations where the patch has not landed. The vulnerability’s reliance on routine administrative actions is its pragmatic strength; the patch is in place, but the window for exploitation remains open until those 3.25 million sites update. For now, the simplest operational control—confirming that All-in-One WP Migration and Backup is at version 7.110 or later before running restores—separates routine maintenance from a potential emergency.
Original reporting: https://www.bleepingcomputer.com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/
