Critical SQL Injection in All-in-One WP Migration Plugin Affects Over 5 Million WordPress Sites

A severe security flaw has been discovered in the All-in-One WP Migration and Backup WordPress plugin, a widely used tool with over 5 million active installations. The vulnerability, identified as CVE-2026-19949, is an unauthenticated second-order SQL injection that can lead to complete site takeover. The issue arises during the archive restore process, where attackers can inject malicious SQL code that is later executed.

The technical analysis reveals that the vulnerability is a second-order SQL injection, meaning the malicious input is stored during one action and only executed during a later process. Attackers can exploit this by submitting crafted trackbacks to a public post. WordPress core stores these values without proper sanitization. The danger materializes when a site administrator performs an archive restore using the All-in-One WP Migration and Backup plugin. During this restore operation, the plugin's replace_table_values() function attempts to rewrite URLs and table prefixes. A flawed regular expression in this function misinterprets specially crafted input, allowing the injected SQL to be executed.

Specifically, the vulnerability lies in the regular expression's handling of quoted string literals. The negative lookbehind mechanism incorrectly identifies the end of a string literal when it is preceded by an even number of backslashes. This allows an attacker to append malicious SQL commands that are then processed by the plugin. By exploiting this, an attacker can steal the plugin's secret key, ai1wm_secret_key, which is stored in the WordPress options table. This key is crucial for the plugin's import functionality and its protection.

Once an attacker obtains the ai1wm_secret_key, they can leverage it to achieve remote code execution (RCE) on the affected WordPress site. This level of access allows for complete control over the website, enabling attackers to deface the site, steal sensitive data, install malware, or use the compromised server for further malicious activities. The unauthenticated nature of the initial exploit makes it particularly dangerous, as any visitor to a vulnerable site could potentially trigger the attack chain without needing any prior access or credentials.

Wordfence researchers discovered the vulnerability and reported it to the plugin developer, ServMask, on August 15, 2026. The developer promptly acknowledged the report and released a patched version, 7.110, on August 20, 2026. Wordfence Premium, Care, and Response users received protection via a firewall rule on August 16, 2026, while the free version of Wordfence will provide protection starting September 15, 2026.

Given the plugin's widespread use and the critical nature of the vulnerability, users of All-in-One WP Migration and Backup are strongly urged to update to version 7.110 immediately. Failure to do so leaves millions of WordPress sites exposed to potential compromise. The vulnerability has a CVSS rating of 8.8, classifying it as High severity.

This incident underscores the ongoing risks associated with popular WordPress plugins and the importance of timely patching. The discovery and responsible disclosure by researchers like Jack Taylor, who earned a $6,400 bounty for this find, are vital in securing the vast WordPress ecosystem. The prompt response from ServMask is commendable and highlights the collaborative effort required to address such critical security issues.