An unauthenticated SQL injection flaw in All-in-One WP Migration and Backup, tracked as CVE-2026-19949, puts more than 5 million WordPress sites at risk of full takeover. The plugin’s developer, ServMask, patched the bug in version 7.110 on August 20, and Wordfence published its full technical disclosure on September 2. As of September 3, roughly 35% of the plugin’s user base had updated, leaving an estimated 3.25 million sites still running a vulnerable copy.
The flaw carries a CVSS score of 8.8 (high severity) and affects every version up to and including 7.109.
How the Attack Actually Works
This isn’t a simple form-field injection. It’s a second-order attack, which is part of why it slipped through for as long as it did. An attacker submits a specially crafted trackback to any public post on the site. That payload sits harmlessly in the database, doing nothing, until a site administrator runs a routine archive export and import using the plugin, something migration and backup tools are used for constantly.
When that restore happens, the plugin rewrites database content but fails to properly escape backslashes and quotation marks in the stored trackback data. That gap lets the injected SQL execute. From there, an attacker can pull the plugin’s ai1wm_secret_key out of the database, and that key is enough to import a malicious .wpress archive, which can plant a webshell or backdoor and hand over full control of the site.
Who Should Care, and What to Do
If a site is running All-in-One WP Migration and Backup, this isn’t optional homework. With 5 million active installs and only about a third of them patched so far, it’s exactly the kind of plugin most agencies and site owners installed once for a migration years ago and never think about again.
- Update to version 7.110 or later immediately.
- If the plugin hasn’t been used for an active migration in a while, consider whether it needs to stay installed at all. Fewer active plugins means a smaller attack surface.
- Check recent comment and trackback activity for anything that looks like injected SQL syntax, particularly around the time of the last archive restore.
- If a restore was run on an unpatched version, treat the site as potentially compromised and audit admin accounts and file changes, not just apply the update.
This is also a good reminder of why a periodic plugin audit matters more than a one-time setup. A lot of these exposures come from utility plugins that were installed for a single task and then left alone. ConicPlex’s WordPress Development and plugin development work regularly turns up exactly this kind of dormant, outdated plugin during a site review, and it’s the same pattern behind last week’s Avada RCE disclosure: widely installed software that quietly falls behind on updates.
