A high-severity SQL injection vulnerability in the popular All‑in‑One WP Migration and Backup plugin is exposing millions of WordPress sites to a remote code execution attack chain that requires no credentials and little attacker effort.[1][2][3][9] The flaw, tracked as CVE‑2026‑19949, affects all plugin versions up to and including 7.109 and is already associated with weaponized exploit code circulating in threat-intelligence feeds, while an estimated 3.25 million installations remain unpatched.[1][2][3][9]
According to the vulnerability description in the National Vulnerability Database, the issue stems from insufficient escaping of user-supplied input and a lack of proper preparation on an existing SQL query inside the plugin’s archive restore functionality.[1] This design flaw enables unauthenticated attackers to append additional SQL statements to the restore query, turning a routine administrative restore operation into a second-order SQL injection that can be abused to read sensitive data from the site’s database.[1][2] Security analysts note that an attacker can use this primitive to extract the ai1wm_secret_key value, which in turn allows them to impersonate an administrator and ultimately execute arbitrary code on the underlying server.[1][2][3]
The plugin, maintained by ServMask and distributed through the official WordPress plugin repository, boasts an install base of more than five million sites, making the blast radius unusually large for a single vulnerability.[2][3][9] Recent reporting indicates that roughly 65 percent of those installations—about 3.25 million WordPress sites—are still running vulnerable versions up to 7.109, meaning they remain directly exposed to this unauthenticated SQL injection and potential remote code execution.[9] Threat-intelligence sources describe exploit code for CVE‑2026‑19949 as “active,” raising the risk that opportunistic attackers will begin scanning for exposed restore endpoints and folding the flaw into mass exploitation campaigns.[3][9]
NVD assigns the bug a CVSS v3.1 base score of 8.8, categorizing it as a high-severity vulnerability with network attack vector, low attack complexity, no required privileges, and no user interaction.[1] The ability to pivot from a database read via SQL injection to full remote code execution means a successful exploit can result in complete loss of confidentiality, integrity, and availability for affected sites.[1][2][3] Security analysts argue that, despite the “high” rather than “critical” CVSS score, the practical impact on real-world WordPress deployments—particularly shared-hosting environments running numerous customer sites—effectively elevates CVE‑2026‑19949 into a critical event.[3]
A patched release, version 7.110 of All‑in‑One WP Migration and Backup, is now available and is documented by multiple sources as resolving CVE‑2026‑19949.[3][4][9] Reporting suggests the fix quietly shipped around August 20 and was not initially highlighted as a security update, increasing the likelihood that administrators may have deferred or overlooked it.[4] Independent analyses and vendor commentary converge on a simple mitigation message: updating to 7.110 or later is currently the only reliable way to remove the vulnerable code path and break the attack chain.[3][4][9]
WordPress site owners running All‑in‑One WP Migration and Backup should immediately update the plugin, then review server and database logs for unusual restore operations or suspicious access patterns around the archive restore functionality.[3][9] Given the potential exposure of the ai1wm_secret_key, defenders should also consider regenerating secrets, auditing administrator accounts, and hardening plugin management policies to limit who can trigger restores.[1][2][3] Web application firewalls may not consistently block this type of second-order SQL injection, so rapid patching, close monitoring, and a broader review of backup and migration workflows remain the most effective defenses while exploit code for CVE‑2026‑19949 is in circulation.[1][3][9]
References
- NVD-CVE-2026-19949 – NIST
- CVE-2026-19949 – All-in-One WP Migration and Backup <= 7.109 – Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
- CVE-2026-19949 · WordPress · CVSS 8.8 · CVE Brief Analyst Report
- High-Severity WP Patches, Unlabeled
- WordPress Backup Plugin Flaw: 3.25 Million Sites Exposed, Exploit Code Active
