A serious security flaw in the All-in-One WP Migration and Backup plugin has put over three million WordPress sites at risk of remote code execution attacks, according to security experts at Defiant. This vulnerability, identified as CVE-2026-19949, has received a CVSS score of 8.8, highlighting its high severity.
The Nature of the Vulnerability
The vulnerability is linked to a second-order SQL injection issue within the plugin’s archive restoration process. Defiant explains that the flaw arises from inadequate escaping of user inputs and poorly prepared SQL queries. This allows attackers to exploit the WordPress core’s trackback feature to extract the secret key used during restore operations.
Using this key, attackers can deploy a malicious plugin that enables remote code execution. The All-in-One WP Migration tool facilitates site backups into .wpress archives, which administrators can restore on different servers. While the restore process is generally unauthenticated, it is safeguarded by a secret key stored during each database restore.
Exploitation and Impact
The CVE-2026-19949 vulnerability allows attackers to submit manipulated trackbacks containing payload URLs, which are stored without proper filtering. When a site is archived and imported, the plugin promotes these inputs to executable SQL. Consequently, the secret key may be exposed in approved comments, making it accessible via the site’s REST API endpoint.
Unauthenticated attackers can use this exposed key to import a tailored .wpress archive with a harmful must-use plugin, which executes malicious code upon the next page load. Defiant warns that this can lead to full site compromise through techniques like webshells.
Current Status and Recommendations
This security flaw affects all versions of the plugin up to 7.109, with a patch provided in version 7.110 released on August 20. Despite being a widely-used tool with over five million active installations, WordPress data from September 3 indicates that only about 35% of users have updated to the safe version. This leaves approximately 3.2 million sites vulnerable.
For site administrators, it is crucial to update to the latest plugin version to mitigate risks. Additionally, monitoring related vulnerabilities, as seen in other WordPress plugins, can help maintain robust site security.
In conclusion, website owners should prioritize immediate updates and employ best practices to protect their digital assets from similar vulnerabilities.
