A critical flaw in the popular All-in-One WP Migration and Backup plugin could let unauthenticated attackers take complete control of vulnerable WordPress websites. The issue, tracked as CVE-2026-19949, affects versions up to 7.109 and has been fixed in version 7.110. Website owners should act quickly, even if no suspicious activity is visible.
Key takeaways
- CVE-2026-19949 affects All-in-One WP Migration and Backup versions up to 7.109.
- More than five million WordPress installations use the plugin.
- The flaw can lead from stored SQL injection to remote code execution.
- Version 7.110 or later should be installed immediately.
- Site owners should review trackbacks, comments, users and recently restored backups.
This is a serious issue for businesses that depend on WordPress for publishing, ecommerce or customer services. A WordPress maintenance plan can help ensure plugin updates, security checks and backups are handled consistently rather than left until an alert appears.
How the vulnerability works
The problem is an unauthenticated second-order SQL injection. In practical terms, an attacker can first store specially crafted data on a public WordPress post using trackbacks. The malicious content remains inactive until an administrator later exports and restores a site with the vulnerable plugin.
During restoration, the plugin rewrites URLs and database table prefixes. Its handling of backslashes and quotation marks can incorrectly interpret the stored data, causing attacker-controlled content to be processed as SQL. This can expose the plugin’s secret import key.
From stolen key to site takeover
Once the secret key is obtained, an attacker may be able to access the plugin’s import process without normal authentication. They could then upload a malicious migration archive containing executable WordPress code, including a must-use plugin that loads automatically.
The result could be remote code execution under the web server account. Attackers might create administrator accounts, install a webshell, change site content, steal database information or use the server to attack other systems. Although an administrator must perform an export-and-import cycle, that is a normal task for many site owners and should not be treated as reliable protection.
What WordPress site owners should do
ServMask fixed the vulnerability in version 7.110. Administrators should:
- Update All-in-One WP Migration and Backup to version 7.110 or later.
- Disable unnecessary trackbacks and pingbacks on public posts.
- Check comments for unusual trackback entries or unexpected URLs.
- Review administrator accounts, installed plugins and recently changed files.
- Investigate backup exports and restores that were not expected.
- Confirm that backups are stored securely and can be restored safely.
Updating is the priority, but it should be part of a wider WordPress care plan. Regular maintenance can also include malware scans, uptime monitoring, tested backups and checks for unauthorised changes.
Why ongoing maintenance matters
A single plugin update can close the immediate vulnerability, but it cannot reveal whether a site was already compromised. Professional WordPress maintenance provides a repeatable process for applying updates, checking website health and responding to security warnings.
Businesses without in-house technical support may benefit from a managed WordPress maintenance plan, particularly when their websites handle customer data or generate sales. A proactive approach reduces the chance that a routine migration or backup restoration becomes the trigger for a serious breach.
Sources
- SQL injection vulnerability in WordPress plugin affects millions of sites | brief, SC Media.
- WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover, Cyber Press.
- WordPress Plugin Flaw Exposes 5 Million Sites to SQL Injection Attacks, CyberSecurityNews.
- WordPress Plugin Flaw Lets Attackers Turn SQL Injection Into Complete Site Takeover, GBHackers News.