A high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin affects versions up to 7.109 and could let unauthenticated attackers reach remote code execution under the right conditions, according to Wordfence. The plugin has more than 5 million active installations, making the issue relevant to a large portion of the WordPress ecosystem.
What Wordfence found in All-in-One WP Migration and Backup
Wordfence says it received the disclosure on August 14, 2026, through its Bug Bounty Program from researcher Jack Taylor, who was awarded $5,761.00 for the report. The flaw is tracked as CVE-2026-19949 and carries a CVSS score of 8.8, which places it in the high-severity range.
The affected plugin, also identified as all-in-one-wp-migration, is used to package a WordPress site into a proprietary .wpress archive and restore that archive on another server. Wordfence says the vulnerability exists in versions 7.109 and earlier, and that 7.110 is the patched release.
According to the advisory, the problem is an unauthenticated second-order SQL injection tied to the plugin’s archive restore process. In practical terms, attackers do not need an account on the site to plant the payload, but the malicious input is only executed later during a restore operation run by an administrator.
How the attack chain works
Wordfence describes the issue as a multi-step attack chain rather than a single direct injection. The initial payload can be planted through WordPress core trackback functionality on a public post that accepts pings. The attacker submits two trackbacks, and the stored values later become part of data that the plugin processes during export and import.
The vulnerability matters because the plugin rewrites URLs and table prefixes inside SQL statements during restore. Wordfence says the code handling that rewrite contains a flaw in the way it identifies quoted string literals, which can cause it to misread where a string ends and carry attacker-controlled content into the wrong part of the SQL statement.
That stored content can then be transformed during restore in a way that breaks SQL quoting and turns the payload into executable database commands. Wordfence says the result can be used to extract sensitive information from the database, including the plugin’s ai1wm_secret_key.
Why the flaw is called second-order SQL injection
Second-order SQL injection is different from the more familiar kind because the malicious input is not executed immediately when it enters the system. Instead, it is saved in a database or other storage location first, then later processed by a different piece of code that assumes the data is safe.
In this case, the payload is planted ahead of time and only becomes dangerous when a site administrator performs an export followed by an import using the plugin. Wordfence notes that this is a normal workflow for a backup and migration tool, which makes the issue especially important for sites that rely on the plugin for routine maintenance.
From stored input to secret-key theft
Wordfence’s analysis explains that the plugin preserves and restores its secret key around database-restore operations so that imported content does not overwrite it. The attacker’s goal is to abuse the SQL injection to read that key from the database at the right moment in the restore sequence.
Once the ai1wm_secret_key is leaked, the next stage becomes possible. The plugin’s import controller is available without authentication, but it requires the correct secret key before it will proceed. With that key in hand, an attacker can satisfy the check and drive the import action directly.
Wordfence says a crafted .wpress archive can then be used to place a malicious must-use plugin on the target system. Because must-use plugins run automatically on the next page load, this can lead to remote code execution as the web server user and, ultimately, full site compromise.
Timeline of disclosure and response
Wordfence published the following sequence of events around the report:
- August 14, 2026: Wordfence received the vulnerability submission.
- August 15, 2026: The report was validated and disclosed to the vendor through the Wordfence Vulnerability Management Portal.
- August 16, 2026: Wordfence Premium, Wordfence Care, and Wordfence Response users received a firewall rule protecting against known exploits.
- August 17, 2026: The developer acknowledged the report.
- August 20, 2026: ServMask released the fully patched version, 7.110.
- September 15, 2026: Sites using the free version of Wordfence are scheduled to receive the same firewall protection 30 days later.
Wordfence said it disclosed the details to the ServMask team promptly and commended the developer for responding quickly and shipping a fix. The advisory also states that Premium, Care, and Response customers were protected with a firewall rule before the patched plugin version was released.
What WordPress site owners should do now
The most important step is straightforward: update All-in-One WP Migration and Backup to version 7.110 or later as soon as possible. Wordfence urges users to patch quickly because the vulnerability is unauthenticated and could be exploited once an attacker has planted the trigger data.
Site owners should also review whether the plugin is installed at all, since its popularity means many administrators may have forgotten it is present on their sites. If it is not needed, removing it reduces exposure. For sites that rely on it for migrations or backups, updating should be treated as urgent maintenance rather than a routine enhancement.
It is also worth remembering that the exploit path depends on a later restore action. That means a site may appear unaffected until an administrator performs an export and import cycle. The backup workflow itself is legitimate, but in this case it is the mechanism that causes the stored payload to execute.
Key details at a glance
- Plugin: All-in-One WP Migration and Backup
- Affected versions: 7.109 and earlier
- Patched version: 7.110
- CVE: CVE-2026-19949
- CVSS score: 8.8
- Researcher: Jack Taylor
- Bounty: $5,761.00
- Impact: SQL injection, secret-key theft, possible remote code execution
For WordPress users, this advisory is another reminder that backup and migration tools carry especially sensitive privileges. When they are flawed, the result can be broader than data corruption or a failed restore. In this case, Wordfence says the chain can end with full site takeover.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: September 2, 2026 at 1:53 am
3 views
