A serious security flaw in the All-in-One WP Migration and Backup plugin could allow attackers to take control of vulnerable WordPress websites.
The vulnerability, tracked as CVE-2026-19949, is a high-severity SQL injection issue that can ultimately lead to remote code execution and full website takeover.
The vulnerability affects All-in-One WP Migration and Backup versions through 7.109. Researchers at Wordfence say the problem is caused by the plugin incorrectly handling escaped backslashes and quotation marks while rewriting database content during the restoration of backup archives.
An unauthenticated attacker could plant specially crafted data through WordPress trackbacks. That malicious data would remain dormant until an administrator exports and imports the website, which are common tasks for a backup and migration plugin.
Once triggered, the injected SQL could expose the plugin’s secret import key, known as ai1wm_secret_key. An attacker could then use the key to import a malicious .wpress backup containing executable code, potentially giving them complete control over the affected website.
The plugin has more than five million active installations, and the update rate remains a major concern. According to the supplied report, only around 35% of users had upgraded after the fix was released, leaving roughly 3.25 million websites running a vulnerable version.
The exploit does require an administrator to restore a backup before the malicious SQL payload is triggered. While this reduces the immediate risk, researchers point out that restoring backups is a normal part of the plugin’s intended use, making the requirement less of a barrier in real-world situations.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Wordfence disclosed the vulnerability to ServMask, the plugin’s developer, on August 15 after validating the security research. ServMask fixed the issue in version 7.110 on August 20.
