SQL Injection Flaw in All-in-One WP Migration Risks Millions of Sites

A critical second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin has left millions of WordPress websites open to full system takeover. The flaw allows unauthenticated attackers to plant malicious data that executes when a site administrator performs a routine backup restoration.

Tracked as CVE-2026-19949, the vulnerability affects all versions of the plugin through 7.109. The attack begins when an unauthenticated actor plants crafted data via trackbacks. This payload remains dormant until an administrator restores a backup archive, at which point the SQL injection triggers. This process can leak the plugin's secret import key, known as the ai1wm_secret_key, which subsequently allows the attacker to upload malicious archives to achieve remote code execution (RCE) and complete control of the website.

The Technical Gap

All-in-One WP Migration and Backup is a cornerstone tool for the WordPress ecosystem, used by administrators to export, import, and migrate entire sites, including databases and media. The vulnerability stems from a failure in the plugin's database rewriting process during archive restoration. Specifically, the software incorrectly parses escaped backslashes and quotation marks, creating the opening for the second-order injection. The flaw was discovered by security researcher Jack Taylor and reported through Wordfence.

Industry Impact

The scale of the risk is significant due to the plugin's massive install base. With over 5 million active installations, the potential attack surface is vast. Wordfence reports that approximately 3.25 million sites remain vulnerable, noting that only 35% of users have applied the necessary updates to secure their environments.

Because the exploit relies on the restoration of a backup—the core purpose of the plugin—the trigger is a routine operation for its users. Wordfence emphasized that while the injected SQL does not execute immediately, the nature of the plugin's primary function makes the eventual trigger highly likely for active users.

Next Steps for Administrators

Site owners using All-in-One WP Migration and Backup must update the plugin immediately to a version beyond 7.109 to mitigate the risk of RCE. Security teams should monitor for unauthorized archive uploads and audit trackback logs for suspicious entries. While the vulnerability is now public, the high number of unpatched sites suggests that attackers may continue to target vulnerable installations until update rates increase significantly.