Vulnerability in Popular WordPress Backup Plugin Threatens Takeover of Millions of Sites

Researchers at Wordfence, a division of the company Defiant, have disclosed a vulnerability in the All-in-One WP Migration and Backup plugin for WordPress. The tool is used to back up, export, import and migrate entire sites — along with their databases, media files, themes and plugins — between servers and domains. It has more than five million active installations.

The flaw has been assigned the identifier CVE-2026-19949 and rated high severity. It was discovered by researcher Jack Taylor, who reported the finding in mid-August. The issue affects plugin versions up to and including 7.109 and is a second-order SQL injection: the plugin incorrectly handles escaped backslashes and quotes when it rewrites the contents of the database while restoring an archive.

How the attack is triggered

An unauthenticated attacker can inject crafted data through the WordPress trackback mechanism. On its own this “payload” stays dormant — it fires only when an administrator performs an export and a subsequent import of the site. These very operations are the plugin's core purpose, so sooner or later an administrator will carry them out.

During restoration the injected SQL code executes and can expose the plugin's secret import key (ai1wm_secret_key) through a public comment. Having obtained the key, the attacker can upload a malicious .wpress archive containing executable code. According to Wordfence, code execution at that privilege level leads to a full takeover of the site.

The researchers note that requiring an administrator's action somewhat reduces the immediate risk, but does not eliminate it: backup and restore are routine procedures for this plugin. Even a deactivated vulnerable version remains potentially dangerous if it is temporarily enabled.

Timeline and scale

Wordfence notified the developer, the company ServMask, on August 15, and a fixed version, 7.110, was released on August 20. The problem, however, is that only about a third of users — roughly 35% — have updated. The remaining 3.25 million sites are still running vulnerable builds. Owners should update the plugin to the latest version without delay.

Source: Bleeping Computer