A critical SQL injection vulnerability has been discovered in the All-in-One WP Migration and Backup plugin for WordPress, a widely used plugin with millions of active installations. The flaw allows unauthenticated attackers to exploit the vulnerability without any prior authentication or privileges. Successful exploitation can lead to remote code execution, enabling attackers to take full control of affected WordPress websites. The vulnerability poses a significant risk given the plugin's large install base, potentially exposing millions of sites to takeover attacks. Website administrators are urged to update the plugin immediately to a patched version to mitigate the risk.
CVE-2026-19949 is a second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin (versions through 7.109). The flaw arises from incorrect parsing of escaped backslashes and quotation marks during database content rewriting at archive restoration time. An unauthenticated attacker can plant crafted malicious data via WordPress trackbacks. This payload remains dormant until an administrator performs an export/import operation, at which point the stored data is executed as SQL. The injected SQL can expose the plugin's secret import key (ai1wm_secret_key) through a public comment. Once the attacker obtains this key, they can import a malicious '.wpress' archive containing executable code, potentially leading to full remote code execution and complete takeover of the target website. The exploit requires no authentication to plant the payload but relies on a privileged admin action (backup restore) to trigger execution.
1. Update the All-in-One WP Migration and Backup plugin to version 7.110 or later immediately, as this version contains the fix released by ServMask on August 20. 2. Audit WordPress trackbacks and comments for suspicious or unexpected entries that may contain crafted SQL payloads. 3. Check if the plugin's secret import key (ai1wm_secret_key) has been exposed in any public comments, and regenerate it if necessary. 4. Monitor for unauthorized or unexpected backup import/restore operations. 5. If unable to update immediately, consider deactivating the plugin temporarily to reduce risk. 6. Restrict or disable WordPress trackbacks if not needed. 7. Use a WordPress security plugin such as Wordfence to detect and block exploitation attempts.
Malicious '.wpress' archive files used for import, Unexpected or unauthorized WordPress trackback submissions containing crafted SQL payloads, Public comments exposing the ai1wm_secret_key value, Unexpected import operations triggered via the ai1wm_secret_key
