Full Report
An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. [...]
Analysis Summary
# Morning News Roll-up September 2, 2026
## Overview
A critical vulnerability in a high-profile WordPress migration plugin poses a significant risk to millions of websites, potentially allowing for full site takeover through second-order SQL injection.
## Top Stories
### All-in-One WP Migration and Backup SQL Injection
- Summary: A high-severity second-order SQL injection vulnerability (CVE-2026-19949) affects the All-in-One WP Migration and Backup plugin. Unauthenticated attackers can plant malicious data via WordPress trackbacks that execute when an administrator performs a site restoration or export. This can lead to the exposure of secret keys and remote code execution.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/wordpress-backup-plugin-flaw-exposes-millions-of-sites-to-takeover-attacks/
### Critical Patch Lag for WordPress Plugin Users
- Summary: Despite a patch being available since August 20, approximately 3.25 million websites (65% of the user base) remain vulnerable to CVE-2026-19949. The vulnerability is particularly dangerous because it facilitates complete website takeover once the administrative action of backup/restore is triggered.
- Source: hxxps://www[.]wordfence[.]com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin/
### The Blue Report 2026: Post-Access Defense Gaps
- Summary: Research indicates that security prevention scores drop sharply once attackers gain valid credentials, with only 37% of malicious actions being blocked after initial access. This highlights the risk posed by vulnerabilities like CVE-2026-19949, which can be used to escalate privileges and secure persistent access.
- Source: hxxps://hubs[.]li/Q04sB3fb0
***
# All-in-One WP Migration and Backup SQL Injection
## Main Topic
A second-order SQL injection vulnerability (CVE-2026-19949) in the All-in-One WP Migration and Backup WordPress plugin allows unauthenticated attackers to achieve remote code execution (RCE) and full site takeover by exploiting the way the plugin handles database content during archive restoration.
## Key Points
- **Vulnerability Type:** Second-order SQL injection caused by incorrect parsing of escaped backslashes and quotation marks during database rewriting.
- **Trigger Mechanism:** The exploit is "dormant" and requires an administrator to perform a routine export or import/restoration operation to trigger the malicious SQL execution.
- **Impact:** Attackers can leak the `ai1wm_secret_key`, which allows them to import a malicious `.wpress` archive containing executable code.
- **Scale:** Over 5 million active installations are affected, with over 3 million sites estimated to be currently unpatched.
## Threat Actors
- **Attribution:** No specific threat actor group is currently attributed to active exploitation; however, the vulnerability was discovered and reported by security researcher Jack Taylor via Wordfence.
- **Motivation:** Likely site takeover, data theft, or distribution of malware via compromised high-traffic WordPress sites.
## TTPs
- **Initial Vector:** Unauthenticated planting of crafted data through WordPress trackbacks.
- **Persistence/Execution:** The payload is stored in the database until an admin action (Export/Import) triggers the processing of SQL string boundaries.
- **Data Exfiltration:** Using injected SQL to expose the plugin’s internal secret key (`ai1wm_secret_key`) through public-facing elements like comments.
- **Privilege Escalation:** Importing a malicious `.wpress` file to execute code at the server level.
## Affected Systems
- **Platform:** WordPress sites using the All-in-One WP Migration and Backup plugin.
- **Versions:** Versions up to and including **7.109**.
- **Scope:** Approximately 5 million active installations; vulnerability persists even if the plugin is deactivated (but becomes exploitable upon activation).
## Mitigations
- **Update:** Immediately update the All-in-One WP Migration and Backup plugin to version **7.110** or later.
- **Monitoring:** Monitor for unusual WordPress trackbacks or unauthorized comments that may contain parts of the `ai1wm_secret_key`.
- **Administrative Caution:** Exercise caution when restoring backups if the site has not been updated, as this action triggers the exploit.
## Conclusion
CVE-2026-19949 represents a significant risk due to the massive install base of the affected plugin and the high impact of successful exploitation. Because the exploit relies on a routine administrative task (restoring a backup), it is highly likely to be successful on unpatched systems over time. Administrators should prioritize updating this plugin immediately to prevent full site compromise.