A high‑severity SQL injection bug in the All‑in‑One WP Migration and Backup plugin allows unauthenticated attackers to take full control of sites. Over 3 million installations remain vulnerable despite a fix released in August.

  • All-in-One WP Migration plugin affected by CVE‑2026‑19949.
  • Over 3 million sites remain on vulnerable versions.
  • Exploits can lead to full site takeover via SQL injection.

Security researcher Jack Taylor uncovered a high‑severity second‑order SQL injection flaw in the popular All‑in‑One WP Migration and Backup plugin for WordPress. The vulnerability, catalogued as CVE‑2026‑19949, allows unauthenticated attackers to inject malicious SQL when the plugin processes archive restoration.

How the Exploit Works

The plugin mishandles escaped backslashes and quotation marks while rewriting database content during a backup import. By submitting crafted data through WordPress trackbacks, an attacker can embed a malicious “.wpress” archive. When an administrator later exports or imports the site—both routine operations for the plugin—the injected SQL runs, exposing the plugin’s secret import key (ai1wm_secret_key) and enabling execution of arbitrary code.

Read Also:Two Young Hackers Sentenced to 5.5 Years for Major TfL Breach

Scope and Impact

According to WordPress.org statistics, the plugin powers more than five million active installations. Since the vendor released a fix in version 7.110 on August 20, only about 35 % of users have updated, leaving roughly 3.25 million sites exposed.

Vendor Response and Mitigation

ServMask, the developer behind the plugin, was notified on August 15 and issued the patch within five days. Site owners are urged to update immediately, deactivate the plugin if not in use, and audit logs for any suspicious import activity.

Why This Matters

BozokMedia analysis shows that a breach of this scale can cascade into broader WordPress ecosystem attacks, as compromised sites often serve as vectors for malware distribution and phishing campaigns.

“The ability to execute code during a routine backup restores the trust model of WordPress sites,” says Jack Taylor, the discoverer.
Did You Know?: The All‑in‑One WP Migration plugin was the top‑ranked backup solution on the WordPress plugin repository in 2024.

Frequently Asked Questions

Q1: Can the vulnerability be exploited without a backup restore?
A: Exploitation requires the admin to perform an import or export, but a deactivated vulnerable version can still be abused if re‑activated.

Q2: Does updating the plugin fully eliminate the risk?
A: Updating to version 7.110 patches the flaw, but sites should also rotate the secret import key and review recent activity.