486/69 Friday, September 4, 2026
Reports have disclosed a vulnerability in the All-in-One WP Migration and Backup plugin for WordPress, tracked as CVE-2026-19949, with a CVSS score of 8.8. The flaw is a Second-Order SQL Injection vulnerability affecting version 7.109 and earlier. The plugin is used on more than 5 million websites, and reports indicate that approximately 3.2 million sites may still be running vulnerable versions because they have not yet updated to version 7.110. This report concerns vulnerability disclosure and patch availability. There is currently no indication that the flaw has been actively exploited.
The vulnerability is caused by insufficient validation and handling of input in the plugin’s archive restore function. An unauthenticated attacker could inject specially crafted data through WordPress’s trackback function. The data would then be stored in the system and would not execute immediately, but could be processed when an administrator exports and imports the website. If the required conditions are met, the injected SQL could be used to extract the plugin’s secret key and then import a .wpress file containing a malicious plugin, potentially allowing the attacker to execute code on the affected website.
Administrators using All-in-One WP Migration and Backup should check the version in use and update to version 7.110 or later as soon as possible. They should also avoid restoring archive files from unknown sources and inspect for abnormal trackbacks or comments, unauthorized .wpress imports, suspicious PHP files, or administrator accounts created without a known reason. If there is a risk that the secret key or other sensitive information has been exposed, administrators should review logs to assess the scope of impact and rotate any related credentials.