A high-severity vulnerability in the All-in-One WP Migration and Backup plugin could allow unauthenticated attackers to take over vulnerable WordPress sites. The flaw, tracked as CVE-2026-19949, affects more than 5 million active installations and has been fixed in version 7.110.
The issue was reported to Wordfence on August 14, 2026, by security researcher Jack Taylor through the Wordfence Bug Bounty Program. Taylor received a $5,761 bounty for discovering the vulnerability, which received a CVSS score of 8.8.
All-in-One WP Migration and Backup is widely used to export, import, restore, and migrate WordPress sites. It creates .wpress archive files containing website files and database data.
The vulnerable versions, up to and including 7.109, contain an unauthenticated second-order SQL injection flaw in the archive restore process.
Unlike a typical SQL injection attack, the malicious SQL code is not executed immediately. An attacker can first place a specially crafted payload in a WordPress site through the core trackback feature. Trackbacks can be submitted without logging in when a public post accepts pings.
WordPress All-in-One WP Migration Plugin Flaw
The attacker submits malicious trackback data with a carefully prepared blog name and URL. WordPress stores that data in the comments table. At this stage, the payload remains inactive and appears to be ordinary comment-related data.
The attack becomes dangerous when a site administrator exports the website using the plugin and later restores it. During restoration, All-in-One WP Migration rewrites URLs and database table prefixes in SQL statements before importing them.
According to a Wordfence report, a flaw in the plugin’s regular expression handling of backslashes and quoted strings can cause the stored payload to escape its intended SQL string boundary.
As a result, attacker-controlled content can become executable SQL during the database restore process. The injected SQL can retrieve the plugin’s ai1wm_secret_key, a secret value used to protect the plugin’s unauthenticated import action.
The attacker can then leak this secret key into an approved comment and retrieve it through the site’s public WordPress REST API. With the secret key, the attacker may access the plugin’s import process and upload a malicious .wpress archive.
A crafted archive could include a malicious must-use WordPress plugin. Since must-use plugins load automatically, the malicious code can execute when a visitor or administrator opens a page.
This can grant the attacker remote code execution on the server and enable a full site compromise, including deploying a webshell, stealing data, or installing additional malware.
The exploit requires an administrator to perform an export followed by an import after the malicious trackbacks have been planted. Although this adds an interaction requirement, backup and restore operations are routine tasks for many WordPress administrators.
Wordfence deployed a firewall rule for Premium, Care, and Response users on August 16, 2026. Free Wordfence users are scheduled to receive the protection on September 15, 2026. ServMask acknowledged the report on August 17 and released version 7.110 on August 20.
Website owners using All-in-One WP Migration and Backup should update immediately, turn off unnecessary trackbacks, review suspicious comments, and verify that no unauthorized plugins or administrator accounts have been added.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post WordPress Plugin Flaw Exposes 5 Million Sites to SQL Injection Attacks appeared first on Cyber Security News.