3.2M WordPress sites exposed by migration plugin flaw
Over 3.2 million WordPress sites are vulnerable to CVE-2026-19949, a second-order SQL injection in All-in-One WP Migration and Backup that can enable unauthenticated remote code execution.
Security firm Defiant identified a high-severity remote code execution flaw, tracked as CVE-2026-19949 (CVSS 8.8), in the All-in-One WP Migration and Backup WordPress plugin. The bug is a second-order SQL injection in the plugin’s archive restore feature that can allow unauthenticated attackers to extract a secret import key and install a malicious archive.
The exploit chain begins with WordPress core’s trackback feature. An attacker can submit two trackbacks to a public post, each containing a trailing backslash and a URL pointing to a payload. The plugin stores those values without stripping the backslashes or rejecting the URLs. When an administrator exports and later imports the site, the plugin rewrites URLs and table prefixes in the stored SQL. During that rewrite, attacker-supplied input is promoted into executable SQL, which causes the secret import key to be written into an approved comment that becomes publicly visible.
An unauthenticated actor can retrieve the secret key via the site’s public comments REST API endpoint and use it to import a crafted .wpress archive. The malicious archive can include a must-use plugin that executes on the next page load, enabling remote code execution. Defiant warned that successful exploitation can lead to full site compromise, including installation of webshells and other persistent backdoors.
The vulnerability affects all All-in-One WP Migration and Backup versions up to 7.109 and was patched in version 7.110, released on August 20. The plugin has more than 5 million active deployments. WordPress plugin data cited by Defiant showed that as of September 3 only 35% of installations had updated to 7.110, leaving roughly 3.2 million sites on vulnerable versions.
Site operators running versions earlier than 7.110 should update the plugin immediately to close the vulnerability. Defiant published technical details of the flaw and the exploit chain in its advisory to help administrators confirm exposure and apply the patch.
Articles by this author
