Security incident · 25 Aug 2026
All-in-One WP Migration: a restore could hand over the site
A hidden SQL injection in All-in-One WP Migration and Backup (5M+ installs) let attackers plant data that fired during the next export or restore, leaking the key needed to take over the site.
- Component
- All-in-One WP Migration and Backup
- CVE
- CVE-2026-19949
- CVSS
- 8.8
- Affected versions
- ≤ 7.109
- Fixed in
- 7.110 (7.111 for CVE-2026-81810)
- Type
- SQL injection
- Status
- Proof of concept public
- Disclosed
- 25 Aug 2026
What happened
All-in-One WP Migration and Backup is one of the most installed WordPress plugins, with more than 5 million active sites. Versions up to 7.109 had a second-order SQL injection rated 8.8.
"Second-order" means the attack happens in two steps. First, an attacker with no account plants crafted data through public inputs. Trackbacks on a public post were the example researchers gave. Nothing happens yet. Then, when an admin runs an export or a restore, the plugin processes that stored data and leaks its secret key. With the key, the attacker can import a crafted archive containing a malicious plugin and take over the site.
The nasty part: routine maintenance is what sets it off.
Who is affected
- Any site running All-in-One WP Migration and Backup 7.109 or earlier.
- Public reports show a proof of concept, but no confirmed attacks in the wild so far.
What to do
- Update to 7.111 or later. That covers this flaw and a second, smaller one (CVE-2026-81810, rated 7.2) fixed in 7.111.
- If you only use the plugin once in a while, for a move or a one-off backup, deactivate and remove it between uses.
- Before your next restore on an old version, update first.
Timeline
- Aug 15, 2026: Wordfence privately reports the flaw to ServMask.
- Aug 20, 2026: ServMask releases 7.110 with the fix.
- Aug 25, 2026: CVE-2026-19949 published.
- Early Sept 2026: Wordfence and BleepingComputer publish technical write-ups.
- Sept 18, 2026: Related flaw CVE-2026-81810 published, fixed in 7.111.